Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About zekebashi
04-15-2019
zekebashi
Member since
05-01-2014
Participant
M.S. IT| CCNP | PCNSE
04-15-2019
08:26 AM
Hello, I have performed the upgrade yet. I have confirmed with Cisco TAC that the upgrade from the 9.2.x to 9.8.x build doesn't require an interim upgrade. My question to TAC: Upgrading from the current release (9.2(4)18) directly to release 9.8.(3)21 is fine. It doesn't require to upgrade to an intermediate releases, is this correct? TAC response: That is correct, is not required to install any intermediate image to get to the desired version 9.8.3.21. Best, ~zK
... View more
04-08-2019
09:28 AM
I didn't say that the other device that was connected by another eng. was a router, but, nonetheless, it was a device that caused the HSRP VIP to create a conflict with another HSRP group (having the same Group ID). I found this post related to the error I pulled from the log https://community.cisco.com/t5/switching/hsrp-4-diffvip1/td-p/2119442 I am not saying that the design we have is a bad one, but some designs have weaknesses and in this case it was obvious that there was a weakness. I presume that you didn't see the diagram I attached in my previous post. The topology shows that the default gateway is 10.1.200.254, which is the IP address assigned to the ASA inside interface; HSRP Group 1: VIP 10.1.200.1; HSRP IP address assigned to core switch 01: 10.1.200.2; and HSRP IP address assigned to core switch 02: 10.1.200.23. My team any I entertained the idea of having the ASAs in ACTIVE/ACTIVE configuration so this way we can have redundant gateways (two MHSRPs = two active ASAs). If one VIP were to fail, then the redundant VIP would still be active. Your input is much appreciated. Best, ~zK
... View more
04-05-2019
03:05 PM
The soft failure that occurred had to do with another eng plugging another device to an access port on one of the core switches. This event caused the HSRP VIP 10.1.200.1 to conflict with another HSRP VIP. See the log entry below. The downstream router is physically connected to both core switches via L2 and has a static route pointing to VIP: 10.1.200.1. So, when the that soft failure(the VIPs conflict) occurred, the downstream router couldn't forward packets to the VIP (10.1.200.1). We can conclude that this a single point of failure. Regarding the connectivity between the two core switches and the pair of HA ASAs, it pretty straight forward, Core SW_01 has a L2 link to a L3 interface (10.1.200.1) --- This is the Primary/Active ASA Core SW_02 has a L2 link to a L3 interface (10.1.200.1) this is the Secondary/standby ASA to the config is identical to the Primary ASA We have a static route/default route to the inside interface of the ASA (10.1.200.1). Now, since we have a single static route pointing to a single active ASA (10.1.200.1), when the HSRP VIP 10.1.200.1 failed the core switch stopped forwarding traffic to this IP address: 10.1.200.1. Had we had two active/active ASAs, then we would have both core switches having two default routes to each ASA. Would this be a viable solution? Thanks in advance, ~zK Here's the log off of the core switch which caused the HSRP VIP 10.1.200.1 to fail: "DT: %HSRP-4-DIFFVIP1: Vlan200 Grp 1 active routers virtual IP address 10.234.80.1 is different to the locally configured address 10.1.200.4"
... View more
04-05-2019
12:11 PM
Thanks for the input. I should probably clarify more.See attached for illustration. - We have EIGRP configured between the two core switches - The two core switches are connected via a Port-Channel Trunk (802.1q) - The downstream RTR belongs to a tenant in the building but we provide them with access to the Internet and a few internal resources (access to internal servers and apps) - On the core switches, we have a default route to the inside interface of the HA ASAs Now, with this design, it appears to me that this design presents a single point of failure irrespective of the redundant physical solution (two core switches connected via a port-channel (bundle of 2x10G physical interfaces), and hsrp). The reason I see it this way is because when you have a single HSRP VIP and a single default route to the active ASA that poses a risk. Going back to my original question, even I have dynamic routing configured between the two core switches and have hsrp configured to provide HA, what happens when some soft failure (in our case anther Cisco device was connected to one of the core switches which caused the VIP to fail)? I was considering the following solutions: - MHSRP - GLBP - And, probably, configure the ASAs in an active/active rather active/passive I do appreciate your feedback/input. Best, ~zK
... View more
04-05-2019
10:02 AM
Hello, We currently have a pair of C6500 connected via a 2x 10G port-channels (802.1q) and have HSRP configured to provide FHRP as HA solution to a downstream router. The router has a default route to one of the HSRPs SVIs (VIP: 10.1.200.1/24; SVI: 10.1.200.2/24 configured on SW_01(Primary); SVI: 10.1.200.3/24 configured on SW_02(Secondary). Last week, we had a soft failure on one of the switches which caused the router to loose connectivity to the network. The soft failure affected the VIP: 10.1.200.1 which caused the connection between the router and switches to fail. My question is, from a design stand point, what are the design alternatives besides HSRP to make this design more resilient than having a single VIP? Meaning, what are the options that I can use besides having the router to point to a single HSRP VIP? Thanks in advance, ~zK
... View more
Labels:
02-26-2019
04:49 PM
Hello,
I have a Peer-link configured using a Port-Channel and it's in production and working fine. The Port-channel currently configured to allow several VLANs. There are several swithport trunk allowed vlan add statements which includes all the allowed VLANs. One of these statements is "switchport trunk allowed vlan add 166-167,186,188,237-238,241,244". I need to add VLAN 168 and wanted to do it right the first time since I am only allowed a short maintenance window and don't have a NX switch to play with. Would should be the correct command to add VLAN 168?
Is it:
switchport trunk allowed vlan add 166-168
OR
switchport trunk allowed vlan add 168
Thanks in advance,
~zK
... View more
- Tags:
- NX9K
Labels:
02-22-2019
12:08 PM
Unfortunately, not with FP service module nor URL filtering.
That's the reason why we are considering to create BYPASS list for all MS FQDNs and IP/Subnets. Out concern is the FQDN dns to IP resolution and what impact it might have on the CPU and Mem!
... View more
02-21-2019
10:29 PM
@Marvin Rhoads ... I am assuming you meant that the FQDN type would not work with wildcard only but would work with regular url; such as, www.cisco.com, correct?
Also, I am required to add a BYPASS acl to include about 450 urls that was provided to us by Microsoft. Is there any performance or utilization issues that might occur as a result of using this high number of urls?
Thanks in advance!!
... View more
Created by
zekebashi
in VPN and AnyConnect
in VPN and AnyConnect
02-01-2019
10:02 AM
02-01-2019
10:02 AM
Hello,
The CLI command would depend on what platform(type of device whether a router or ASA) you are using. One of the commands I use on the ASA to find out whether there's a STS VPN (L2L) or RA VPN (Remote Access) is to issue this command "show ipsec sa" and look under teh crypto map for the "inbound esp sas\in use settings". If the
in use settings ={RA, Tunnel, NAT-T-Encaps, IKEv1, ---> This indicates that the type of VPN is RA ( Remote Access)
in use settings ={L2L, Tunnel, PFS Group 2, IKEv2, } ---> This indicates that the type of VPN is STS (L2L: LAN To LAN, which means Site To Site VPN).
Here's some sources: https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/vpn_site2site.html#28546
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-3s/sec-sec-for-vpns-w-ipsec-xe-3s-book/sec-cfg-vpn-ipsec.html#GUID-3ED7166F-F328-4229-A4B6-D08C0C103E3B
HTH.
Best, ~zK
... View more
02-01-2019
08:44 AM
Thanks for the input. This is helpful!
So, when create a an IKEv2 policy and IKEv2 proposal, where does each get referenced or associated? Let's take this the below config, for example:
Where in the config are the IKEv2 policies used/associated?
The IKEv2 ipsec-proposal is referenced in or associated with the "crypto map MAP_0 1 set ikev2 ipsec-proposal AES AES192 AES25" but I don't see the IKEv2 policies referenced or associated anywhere else in this config!
! crypto ikev2 policy 1 encryption aes-256 integrity sha group 5 2 prf sha lifetime seconds 86400 ! crypto ikev2 policy 10 encryption aes-192 integrity sha group 5 2 prf sha lifetime seconds 86400 ! crypto ikev2 policy 20 encryption aes integrity sha group 5 2 prf sha lifetime seconds 86400 !
! crypto ipsec ikev2 ipsec-proposal AES256 protocol esp encryption aes-256 protocol esp integrity sha-1 md5 ! crypto ipsec ikev2 ipsec-proposal AES192 protocol esp encryption aes-192 protocol esp integrity sha-1 md5 ! crypto ipsec ikev2 ipsec-proposal AES protocol esp encryption aes protocol esp integrity sha-1 md5 ! ! crypto map MAP_0 1 match address ACL_abc crypto map MAP_0 1 set pfs crypto map MAP_0 1 set peer x.x.x.x crypto map MAP_0 1 set ikev2 ipsec-proposal AES AES192 AES256 ! ! crypto map MAP_0 interface outside ! ! group-policy HQ_To_Loc_01 internal group-policy HQ_To_Loc_01 attributes vpn-tunnel-protocol ikev2 split-tunnel-all-dns disable ! ! tunnel-group x.x.x.x type ipsec-l2l tunnel-group x.x.x.x general-attributes default-group-policy HQ_To_Loc_01 tunnel-group x.x.x.x ipsec-attributes ikev2 remote-authentication pre-shared-key abcdefgxxxxxxxx ikev2 local-authentication pre-shared-key abcdefgxxxxxxxx !
Best, ~zK
... View more
Monday
Hello, I have performed the upgrade yet. I have confirmed with Cisco TAC
that the upgrade from the 9...
2 weeks ago
I didn't say that the other device that was connected by another eng.
was a router, but, nonetheless...
2 weeks ago
The soft failure that occurred had to do with another eng plugging
another device to an access port ...
2 weeks ago
Thanks for the input. I should probably clarify more.See attached for
illustration. - We have EIGRP ...
2 weeks ago
Hello,We currently have a pair of C6500 connected via a 2x 10G
port-channels (802.1q) and have HSRP ...
3 weeks ago
Hello,I have an outdated document for the Cisco Data Center Design which
dates back to
2013/2014:htt...
03-21-2019 09:07 AM
I was able to get the admin account working again by simply rebooting
the firewall. Though I was abl...
03-21-2019 09:02 AM
Thanks for the info. It turned out that I had a native VLAN on the trunk
port. Once I removed that n...
03-20-2019 08:50 AM
It appears that way as I've not been able to find any Cisco documents
related to this issue. Thanks,...
03-19-2019 05:23 PM
Hello, We purchased several FirewPower 2100s but not using the FTD;
however, we are only using the h...
03-19-2019 04:36 PM
Hello, I am using a FirePower 2110 and created a new admin account
(myadmin) besides the pre-defined...
02-26-2019 04:49 PM
Hello, I have a Peer-link configured using a Port-Channel and it's in
production and working fine. T...
Public Statistics
| Date Registered | 05-01-2014 12:46 PM |
| Date Last Visited | 04-15-2019 11:47 AM |
| Total Messages Posted | 301 |
| Total Helpful Votes Received | 30 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 10 |
.jpg "Hall of Fame Master"){kind=icon}
.jpg "VIP Advocate"){kind=icon}
Helpful Votes From
