Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Amos Kafwembe
02-17-2019
Amos Kafwembe
Member since
04-14-2011
Beginner
Created by
Amos Kafwembe
in Other Service Provider Subjects
in Other Service Provider Subjects
02-11-2019
02:12 AM
02-11-2019
02:12 AM
Hi guys, If i am receiving a full bgp table from my provider and the table includs the default route. how do i filter out the default route?
... View more
- Tags:
- bgp default route
Labels:
Created by
Amos Kafwembe
in VPN and AnyConnect
in VPN and AnyConnect
07-11-2018
05:49 AM
07-11-2018
05:49 AM
Hi RJI,
Is this secure? also, do you have any sample config on achieving this without tunnel mode?
... View more
Created by
Amos Kafwembe
in VPN and AnyConnect
in VPN and AnyConnect
07-11-2018
12:53 AM
07-11-2018
12:53 AM
Good day all,
I am trying to set up an IPsec VPN on my Cisco ASR920. I found a sample config on the cisco site but one thing I note is that there is no acl to identify interesting traffic in the configuration. how do I capture interesting traffic and send it via the IPsec tunnel with this sample config provided by Cisco?
https://www.cisco.com/c/en/us/td/docs/routers/asr920/configuration/guide/sec_vpn/sec-ipsec-xe-3s-book-920/overview_of_ipsec.html
... View more
Labels:
08-08-2017
05:13 AM
Hi,
so after much Tshooting I finally managed to get this working. Everything i did was correct but apparently, on the Cisco ASR920 series, in order for PBR to work you have to put the config "sdm prefer video" the router will reload after 2 minutes and load the "video" template Nb; PBR will only work with a "video" template!
https://www.cisco.com/c/en/us/td/docs/routers/asr920/configuration/guide/iproute/iri-xe-3s-asr920-book/iri-xe-3s-asr920-book_chapter_01.html
... View more
05-12-2017
12:11 AM
Hi Rick,
the config is as below, the next hop is 10.139.102.2 which is being tracked by an SLA. if the SLA is "up" then the next hop is valid, if it is down, then the next hop is 21.19.3.8
ip next-hop verify-availability 10.139.102.2 10 track 102 [up] ip next-hop 21.19.3.8
... View more
05-10-2017
05:44 AM
Hi,
i've checked and have come to the conclusion that the BM is taking part in the routing. when i check the ARP I can only see the BM's IP address coming in and a few other unrelated IP's. how ever, I am also unable to capture traffic coming in from the internet! which is the same thing happening on the BM facing interface.
interface BDI3963 ip address 19.3.12.10 255.255.255.252 ip policy route-map CACHE_2 ACL capturing traffic from the internet; Extended IP access list CACHE_2 10 permit tcp any eq www 21.19.3.0 0.0.7.255 20 permit tcp any gt 1024 21.19.3.0 0.0.7.255 30 permit tcp any eq www 4.21.6.0 0.0.31.255 40 permit tcp any gt 1024 4.21.6.0 0.0.31.255 route-map CACHE_2, permit, sequence 10 Match clauses: ip address (access-lists): CACHE_2 Set clauses: ip next-hop verify-availability 10.139.102.2 10 track 102 [up] ip next-hop 21.19.3.8 Policy routing matches: 0 packets, 0 bytes
... View more
04-25-2017
11:45 PM
Hi Rick,
basically it is a bandwidth manager. It is responsible for assigning bandwidth to IP addresses within the ranges, it is also responsible for permitting or denying IP addresses access to the internet. it is a transparent device although the link between it and the ASR is running OSPF, thereby "telling" the ASR about the networks below it.
... View more
04-25-2017
07:32 AM
Hi Rick,
thanks for your time.
There is a large network below this interface, the two blocks are actually /21 and /19 respectively. according to what you are saying, it means my IP address on the interface should then be a /19 or /21 in order to encompass the whole subnet? suppose i had a 172.16.0.0 network below this interface which was reachable via an IGP, how then would i capture traffic from that subnet? am not sure about this..attached is the set up;
... View more
04-25-2017
01:54 AM
Hi Rick,
I had upgraded the ASR to the new IOS and was able to configure the policy on the interface. I highly doubt the IP address on the interface has to match the subnets in the ACL.
the set up is like this, I have a cache server which is to cache all traffic as it enters the router from the internet and also to cache traffic as it goes to the internet;
ACL capturing traffic destined to the internet;
Extended IP access list CACHE_1
10 permit tcp 21.19.3.0 0.0.7.255 any eq www 20 permit tcp 21.19.3.0 0.0.7.255 any gt 1024 30 permit tcp 4.21.6.0 0.0.31.255 any eq www 40 permit tcp 4.21.6.0 0.0.31.255 any gt 1024
ACL capturing traffic from the internet;
Extended IP access list CACHE_2
10 permit tcp any eq www 21.19.3.0 0.0.7.255 20 permit tcp any gt 1024 21.19.3.0 0.0.7.255 30 permit tcp any eq www 4.21.6.0 0.0.31.255 40 permit tcp any gt 1024 4.21.6.0 0.0.31.255
the ACL capturing traffic destined to the internet is applied via route-map , it is supposed to send traffic to the Cache before which it goes out to the internet
interface GigabitEthernet0/0/3 ip address 21.19.3.8 255.255.255.254 ip policy route-map CACHE_1
the ACL capturing traffic as it enters from the internet and sends it to the cache before being forwarded to the LAN
interface BDI3963 ip address 19.3.12.10 255.255.255.252 ip policy route-map CACHE_2
Route-maps;
route-map CACHE_2, permit, sequence 10 Match clauses: ip address (access-lists): CACHE_2 Set clauses: ip next-hop verify-availability 10.139.102.2 10 track 102 [up] ip next-hop 21.19.3.8 Policy routing matches: 0 packets, 0 bytes route-map CACHE_1, permit, sequence 10 Match clauses: ip address (access-lists): CACHE_1 Set clauses: ip next-hop verify-availability 10.139.101.2 10 track 101 [up] ip next-hop 19.3.12.10 Policy routing matches: 0 packets, 0 bytes
... View more
04-24-2017
07:39 AM
Hi Richard,
Is it in any way possible that an IOS version would stop PBR from working.. see my config below, i cant seem to get the PBR to work! I am capturing traffic as it leaves my network and have set the next hop as my cache server using an IP SLA which I am tracking...
Gate#show route-map CACHE_1 route-map CACHE_1, permit, sequence 10 Match clauses: ip address (access-lists): CACHE_1 Set clauses: ip next-hop verify-availability 10.139.101.2 10 track 101 [up] ip next-hop 19.3.12.10 Policy routing matches: 0 packets, 0 bytes Gate#show access-lists CACHE_1 Extended IP access list CACHE_1 10 permit tcp 21.19.3.0 0.0.7.255 any eq www 20 permit tcp 21.19.3.0 0.0.7.255 any gt 1024 30 permit tcp 4.21.6.0 0.0.31.255 any eq www 40 permit tcp 4.21.6.0 0.0.31.255 any gt 1024 interface GigabitEthernet0/0/3 ip address 21.19.3.8 255.255.255.254 ip policy route-map CACHE_1
Gate#show track Track 101 IP SLA 101 reachability Reachability is Up 12 changes, last change 00:23:55 Latest operation return code: OK Latest RTT (millisecs) 4 Tracked by: Route Map 0
Gate#show ver Cisco IOS XE Software, Version 03.16.00.S - Extended Support Release Cisco IOS Software, ASR920 Software (PPC_LINUX_IOSD-UNIVERSALK9_NPE-M), Version 15.5(3)S, RELEASE SOFTWARE (fc6) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2015 by Cisco Systems, Inc. Compiled Sun 26-Jul-15 10:01 by mcpre Cisco IOS-XE software, Copyright (c) 2005-2015 by cisco Systems, Inc. All rights reserved. Certain components of Cisco IOS-XE software are licensed under the GNU General Public License ("GPL") Version 2.0. The software code licensed under GPL Version 2.0 is free software that comes with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such GPL code under the terms of GPL Version 2.0. For more details, see the documentation or "License Notice" file accompanying the IOS-XE software, or the applicable URL provided on the flyer accompanying the IOS-XE software. ROM: IOS-XE ROMMON Gate uptime is 23 weeks, 6 days, 16 hours, 39 minutes Uptime for this control processor is 23 weeks, 6 days, 16 hours, 41 minutes System returned to ROM by reload System restarted at 00:01:00 CAT Tue Nov 8 2016 System image file is "bootflash:asr920-universalk9_npe.03.16.00.S.155-3.S-ext.bin" Last reload reason: PowerOn This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to export@cisco.com. License Level: advancedmetroipaccess License Type: Permanent Next reload license Level: advancedmetroipaccess cisco ASR-920-24TZ-M (Freescale P2020) processor (revision 1.2 GHz) with 910182K/6147K bytes of memory. Processor board ID CAT1905V19L 24 Gigabit Ethernet interfaces 4 Ten Gigabit Ethernet interfaces 32768K bytes of non-volatile configuration memory. 3670016K bytes of physical memory. 1328927K bytes of SD flash at bootflash:. Configuration register is 0x2102
... View more
Created by
Amos Kafwembe
in Other Service Provider Subjects
in Other Service Provider Subjects
03-20-2017
12:51 AM
03-20-2017
12:51 AM
makes sense. I am just lab"ing it up and testing...
... View more
03-17-2017
01:15 AM
Hi Francesco,
So, its one path preferred over the other. The two links are terminating on the same router on client side and terminating at two different points to the ISP (geographically separate locations for redundancy)
... View more
Created by
Amos Kafwembe
in Other Service Provider Subjects
in Other Service Provider Subjects
03-16-2017
07:08 AM
03-16-2017
07:08 AM
hi guys,
I am trying to set up BGP multi-homming - two links to a single ISP. someone please point me in the right direction.
... View more
Labels:
Created by
Amos Kafwembe
in Other Security Subjects
in Other Security Subjects
02-07-2017
04:23 AM
02-07-2017
04:23 AM
Hi guys,
I recently implemented some access-lists on my router permitting only my subnet to access it on the VTY lines, the results however are overwhelming, there are so many failed attempts to the VTY lines. I know the ACL is doing its job, but why are there so many attempts? Is there anything further I need to do to harden the router...by the way, I also have a Cisco ACS server set up and its the same story in there too!
2:06:35.687: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 89.120.49.214(11914) -> 0.0.0.0(23), 1 packet Feb 7 12:07:32.889: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 27.77.120.175(56386) -> 0.0.0.0(23), 1 packet Feb 7 12:07:51.057: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 59.126.162.238(26606) -> 0.0.0.0(23), 1 packet Feb 7 12:07:58.382: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 85.217.234.153(3584) -> 0.0.0.0(23), 1 packet Feb 7 12:08:03.758: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 14.157.23.151(63394) -> 0.0.0.0(23), 1 packet Feb 7 12:08:12.534: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 85.104.230.248(43852) -> 0.0.0.0(23), 1 packet Feb 7 12:08:16.914: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 103.199.121.50(19192) -> 0.0.0.0(23), 1 packet Feb 7 12:08:18.394: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 201.23.148.171(25853) -> 0.0.0.0(23), 1 packet Feb 7 12:08:25.010: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 109.103.193.210(37405) -> 0.0.0.0(23), 1 packet Feb 7 12:08:35.823: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 220.134.53.169(49405) -> 0.0.0.0(23), 1 packet Feb 7 12:08:46.679: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 122.116.5.174(31507) -> 0.0.0.0(23), 1 packet Feb 7 12:09:00.400: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 201.74.94.143(1099) -> 0.0.0.0(23), 1 packet Feb 7 12:09:14.652: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 187.18.147.188(34782) -> 0.0.0.0(23), 1 packet Feb 7 12:09:35.817: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 94.61.161.134(57683) -> 0.0.0.0(23), 1 packet Feb 7 12:10:03.702: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 186.210.239.218(60528) -> 0.0.0.0(23), 1 packet Feb 7 12:10:11.050: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 27.115.135.227(61795) -> 0.0.0.0(23), 1 packet Feb 7 12:10:13.350: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 31.46.186.64(21513) -> 0.0.0.0(23), 1 packet Feb 7 12:10:17.310: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 14.176.209.35(32992) -> 0.0.0.0(23), 1 packet Feb 7 12:10:21.806: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 112.197.199.174(46048) -> 0.0.0.0(23), 1 packet Feb 7 12:10:25.550: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 201.191.126.44(5622) -> 0.0.0.0(23), 1 packet Feb 7 12:10:44.483: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 27.159.5.138(12315) -> 0.0.0.0(23), 1 packet Feb 7 12:10:45.503: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 220.134.30.53(19697) -> 0.0.0.0(23), 1 packet Feb 7 12:10:47.015: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 103.44.14.210(37682) -> 0.0.0.0(23), 1 packet Feb 7 12:10:51.263: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 92.92.148.37(32685) -> 0.0.0.0(23), 1 packet Feb 7 12:10:53.807: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 80.82.70.26(45201) -> 0.0.0.0(23), 1 packet Feb 7 12:11:15.812: %SEC-6-IPACCESSLOGRL: access-list logging rate-limited or missed 1 packet Feb 7 12:11:30.232: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 62.194.167.41(1944) -> 0.0.0.0(23), 1 packet Feb 7 12:11:40.008: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 60.194.109.203(11535) -> 0.0.0.0(23), 1 packet Feb 7 12:11:42.588: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 42.87.233.56(56661) -> 0.0.0.0(23), 1 packet Feb 7 12:11:45.572: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 93.63.55.209(45852) -> 0.0.0.0(23), 1 packet Feb 7 12:11:47.773: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 27.109.194.164(35554) -> 0.0.0.0(23), 1 packet Feb 7 12:11:54.441: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 42.117.116.219(11791) -> 0.0.0.0(23), 1 packet Feb 7 12:12:15.841: %SEC-6-IPACCESSLOGRL: access-list logging rate-limited or missed 1 packet Feb 7 12:12:27.482: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 79.116.69.165(7722) -> 0.0.0.0(23), 1 packet Feb 7 12:12:31.194: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 97.94.241.123(46684) -> 0.0.0.0(23), 1 packet Feb 7 12:12:41.694: %SEC-6-IPACCESSLOGP: list VTY_ACCESS denied tcp 175.44.160.6(37357) -> 0.0.0.0(23), 1 packet
... View more
Labels:
Created by
Amos Kafwembe
in Other Service Provider Subjects
02-11-2019 02:12 AM
02-11-2019 02:12 AM
Hi guys, If i am receiving a full bgp table from my provider and the
table includs the default route...
Created by
Amos Kafwembe
in VPN and AnyConnect
07-11-2018 05:49 AM
07-11-2018 05:49 AM
Hi RJI, Is this secure? also, do you have any sample config on achieving
this without tunnel mode?
07-11-2018 12:53 AM
Good day all, I am trying to set up an IPsec VPN on my Cisco ASR920. I
found a sample config on the ...
08-08-2017 05:13 AM
Hi, so after much Tshooting I finally managed to get this working.
Everything i did was correct but ...
05-12-2017 12:11 AM
Hi Rick, the config is as below, the next hop is 10.139.102.2 which is
being tracked by an SLA. if t...
05-10-2017 05:44 AM
Hi, i've checked and have come to the conclusion that the BM is taking
part in the routing. when i c...
04-25-2017 11:45 PM
Hi Rick, basically it is a bandwidth manager. It is responsible for
assigning bandwidth to IP addres...
04-25-2017 07:32 AM
Hi Rick, thanks for your time. There is a large network below this
interface, the two blocks are act...
04-25-2017 01:54 AM
Hi Rick, I had upgraded the ASR to the new IOS and was able to configure
the policy on the interface...
04-24-2017 07:39 AM
Hi Richard, Is it in any way possible that an IOS version would stop PBR
from working.. see my confi...
Created by
Amos Kafwembe
in Other Service Provider Subjects
03-20-2017 12:51 AM
03-20-2017 12:51 AM
makes sense. I am just lab"ing it up and testing...
03-17-2017 01:15 AM
Hi Francesco, So, its one path preferred over the other. The two links
are terminating on the same r...
Created by
Amos Kafwembe
in Other Service Provider Subjects
03-16-2017 07:08 AM
03-16-2017 07:08 AM
hi guys, I am trying to set up BGP multi-homming - two links to a single
ISP. someone please point m...
Created by
Amos Kafwembe
in Other Security Subjects
02-07-2017 04:23 AM
02-07-2017 04:23 AM
Hi guys, I recently implemented some access-lists on my router
permitting only my subnet to access i...
Public Statistics
| Date Registered | 04-14-2011 11:53 PM |
| Date Last Visited | 02-17-2019 11:05 PM |
| Total Messages Posted | 93 |
| Total Helpful Votes Received | 10 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 4 | |
| 3 | |
| 3 | |
| 12 | |
| 3 |
.jpg "VIP Mentor"){kind=icon}
.jpg "Hall of Fame Master"){kind=icon}
