Thank you for your reply. ... View more

Hi Thank you for your reply.   If you refer to link below, it stated the 8 ports are encrypted port. I would like to know how it different from others port. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/hw/installation/guide/nexus_5000_hig/overview5500.html#60491 ... View more

Thank you. Will study NetFlow to understand more. ... View more

Noted the mode setting. Thank you for the valuable info. Noted your recommendation of FirePower. The intention is to have better monitoring on suspicious traffic especially for smtp spamming out from our network. Once alerted, we will investigate manually. Since we have 2 units of C7206 NPE-G1 in store sleeping do nothing, I planned to use them for IDS purpose.    ... View more

Thank you for taking time to reply. I wish to use IDS instead of IPS. My goal is to have alert on suspicious traffic instead of blocking them. The reason is to avoid false positive and blocked good traffic. I am considering using NPE-G1 or IDSM-2. My traffic to WAN is about 100mbps.  ... View more

Wow. The cost for my small mistake is too big.  ... View more

Thank you for your valuable information. I am so stupid to follow all the setting from the link included traffic shaping 128000 in the policy. I removed that and the magic appear. Everything run smooth. Also thank you for your patient :)   ... View more

Ping from HQ Server to tunnel IP at Hotel. Reply from 192.168.10.1: bytes=32 time=3514ms TTL=254 Reply from 192.168.10.1: bytes=32 time=3634ms TTL=254 Reply from 192.168.10.1: bytes=32 time=2790ms TTL=254 Reply from 192.168.10.1: bytes=32 time=3878ms TTL=254 Request timed out. Request timed out. Request timed out. Ping statistics for 192.168.10.1:     Packets: Sent = 186, Received = 156, Lost = 30 (16% loss), Approximate round trip times in milli-seconds:     Minimum = 1562ms, Maximum = 3945ms, Average = 2742ms When it work fine, the ping result should not more than 100ms Pinging 192.168.10.1 with 32 bytes of data: Reply from 192.168.10.1: bytes=32 time=7ms TTL=254 Reply from 192.168.10.1: bytes=32 time=6ms TTL=254 Reply from 192.168.10.1: bytes=32 time=5ms TTL=254 Reply from 192.168.10.1: bytes=32 time=12ms TTL=254 Reply from 192.168.10.1: bytes=32 time=67ms TTL=254 Reply from 192.168.10.1: bytes=32 time=6ms TTL=254 Reply from 192.168.10.1: bytes=32 time=4ms TTL=254 Reply from 192.168.10.1: bytes=32 time=13ms TTL=254 Ping statistics for 192.168.10.1:     Packets: Sent = 8, Received = 8, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 4ms, Maximum = 67ms, Average = 15ms   ... View more

Hotel show result:   HOTEL#show run interface tunnel 0 interface Tunnel0  ip address 192.168.xxx.1 255.255.255.0  ip mtu 1400  ip tcp adjust-mss 1360  keepalive 10 3  tunnel source 222.222.222.230  tunnel mode ipsec ipv4  tunnel destination 111.111.111.157  tunnel protection ipsec profile VTI  service-policy output MAP-VPN end HOTEL#show interface Tunnel0 Tunnel0 is up, line protocol is up   Hardware is Tunnel   Internet address is 192.168.xxx.1/24   MTU 17886 bytes, BW 100 Kbit/sec, DLY 50000 usec,      reliability 255/255, txload 255/255, rxload 114/255   Encapsulation TUNNEL, loopback not set   Keepalive set (10 sec), retries 3   Tunnel source 222.222.222.230, destination 111.111.111.157   Tunnel protocol/transport IPSEC/IP   Tunnel TTL 255   Tunnel transport MTU 1446 bytes   Tunnel transmit bandwidth 8000 (kbps)   Tunnel receive bandwidth 8000 (kbps)   Tunnel protection via IPSec (profile "VTI")   Last input never, output never, output hang never   Last clearing of "show interface" counters never   Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 195   Queueing strategy: fifo   Output queue: 0/0 (size/max)   5 minute input rate 45000 bits/sec, 56 packets/sec   5 minute output rate 103000 bits/sec, 59 packets/sec      889709 packets input, 100859024 bytes, 0 no buffer      Received 0 broadcasts, 0 runts, 0 giants, 0 throttles      0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort      1131657 packets output, 532315152 bytes, 0 underruns      0 output errors, 0 collisions, 0 interface resets      0 unknown protocol drops      0 output buffer failures, 0 output buffers swapped out HOTEL#show interfaces fastEthernet 4 FastEthernet4 is up, line protocol is up   Hardware is PQII_PRO_UEC, address is xxxx.xxxx.xxxx (bia xxxx.xxxxc.xxxx)   Internet address is 222.222.222.230/30   MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,      reliability 255/255, txload 1/255, rxload 1/255   Encapsulation ARPA, loopback not set   Keepalive set (10 sec)   Full-duplex, 100Mb/s, 100BaseTX/FX   ARP type: ARPA, ARP Timeout 04:00:00   Last input 00:00:00, output 00:00:00, output hang never   Last clearing of "show interface" counters never   Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 1146   Queueing strategy: Class-based queueing   Output queue: 61/1000/0 (size/max total/drops)   5 minute input rate 602000 bits/sec, 107 packets/sec   5 minute output rate 169000 bits/sec, 107 packets/sec      13104241 packets input, 4056051361 bytes      Received 1 broadcasts, 0 runts, 0 giants, 0 throttles      0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored      0 watchdog      0 input packets with dribble condition detected      8522707 packets output, 1225440002 bytes, 0 underruns      0 output errors, 0 collisions, 2 interface resets      0 unknown protocol drops      0 babbles, 0 late collision, 0 deferred      0 lost carrier, 0 no carrier      0 output buffer failures, 0 output buffers swapped out HOTEL# show policy-map interface Tu0  Tunnel0   Service-policy output: MAP-VPN     Class-map: class-default (match-any)       1131522 packets, 478035403 bytes       5 minute offered rate 97000 bps, drop rate 2000 bps       Match: any       Queueing       queue limit 64 packets       (queue depth/total drops/no-buffer drops) 61/1151/0       (pkts output/bytes output) 1131128/553358664       shape (average) cir 128000, bc 512, be 512       target shape rate 128000 HOTEL#show proc cpu history HOTEL   07:24:04 AM Tuesday Apr 28 2015 UTC       333334444433333333334444433333555554444444444555553333333333 100  90  80  70  60  50  40  30  20  10                               *****          *****    0....5....1....1....2....2....3....3....4....4....5....5....6              0    5    0    5    0    5    0    5    0    5    0                CPU% per second (last 60 seconds)       111111111    11  1               11                    1     572464626556565324786674544434438571355764343356455645649064 100  90  80  70  60  50  40  30  20     * * ***        *  10 **#########****## *#*** *       *********     ** *** ** ***    0....5....1....1....2....2....3....3....4....4....5....5....6              0    5    0    5    0    5    0    5    0    5    0                CPU% per minute (last 60 minutes)               * = maximum CPU%   # = average CPU%     11512111   111112 1111 111314     09793323979524301604928544868 100  90  80  70  60   *  50   *                         *  40   *                       * *  30   *                       * *  20  ****      *    *   *  *  ***  10 *####*#*******************#**    0....5....1....1....2....2....3....3....4....4....5....5....6....6....7..              0    5    0    5    0    5    0    5    0    5    0    5    0                    CPU% per hour (last 72 hours)                   * = maximum CPU%   # = average CPU% HOTEL#show version Cisco IOS Software, C880 Software (C880DATA-UNIVERSALK9-M), Version 15.0(1)M5, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2011 by Cisco Systems, Inc. Compiled Wed 23-Feb-11 19:52 by prod_rel_team ROM: System Bootstrap, Version 12.4(22r)YB5, RELEASE SOFTWARE (fc1) HOTEL uptime is 1 day, 5 hours, 46 minutes System returned to ROM by reload at 01:33:23 UTC Mon Apr 27 2015 System image file is "flash:c880data-universalk9-mz.150-1.M5.bin" Last reload type: Normal Reload Last reload reason: Reload Command   This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to export@cisco.com. Cisco 881 (MPC8300) processor (revision 1.0) with 236544K/25600K bytes of memory. Processor board ID FGL1518214M 5 FastEthernet interfaces 1 Virtual Private Network (VPN) Module 256K bytes of non-volatile configuration memory. 126000K bytes of ATA CompactFlash (Read/Write) License Info: License UDI: ------------------------------------------------- Device#   PID                   SN ------------------------------------------------- *0        CISCO881-K9           FGL1518214M   License Information for 'c880-data'     License Level: advsecurity   Type: Permanent     Next reboot license Level: advsecurity Configuration register is 0x2102 HOTEL#   ... View more