Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About paul1202
Stats
Member since
03-13-2014
29
Posts
10
Helpful
0
Solutions
09-13-2019
03:24 AM
Hi All, A customer wants to authenticate Anyconnect VPN users from an ASA using the client installed certificate and then with AD. i.e. Is this a corporate device? Would we recommend authenticating the cert on the ASA then passing the AD check to ISE or can we do both on the ISE which is the preferred option? The ASA is running 9.2.1 so I believe there is no requirement for an IPN as the ASA can do the CoA. Any configuration guidelines would be appreciated. If in the future they want to perform posturing on the Clients, would this affect the recommended solution above? Regards, Paul.
... View more
11-03-2018
03:31 AM
Hi Rick, So for the late reply. Yes, changing the master key resolved the issue. The customer wasn't sure what they were so I simply removed the keys and created new ones on both sides. The Tunnel came straight up and all traffic encrypted across it. Thanks again for your interest. Regards, Paul
... View more
10-29-2018
02:39 AM
Thanks for your reply Rick.
Speaking with the customer and doing further checking, it appears there is a master key which is used to encrypt any exisiting keys in the router configuration using AES. and which cannot be seen in or obtained in the configuration.
password encryption aes
key config-key passowrd-encrypt
I am hoping to try the above in the next day or so to confirm the fix.
Paul
... View more
10-23-2018
07:00 AM
Thanks for your reply Marvin.
I managed to lab the scenario (different router platforms) and you are correct :-)
The issue I have is a direct router replacement for one of them with a hostname only change will not re-establish the IPSec tunnel.
The only difference from my lab setup is they are using an encrypted pre-shared key where I am using plain-text. I will see if that for whatever reason it makes a difference!
... View more
10-23-2018
04:06 AM
Hi All,
If I have an exisiting IPSec tunnel between 2 routers and one of the routers has a hostname change, will the IPSec fail either straight away or say at a reload of either device?
Is there a trust between the 2 devices using the hostname, even if the default crypto isakmp identity address is configured on both sides.
I assume I would have to create a new crypto key for the hostname change router.
Thanks,
Paul
... View more
Labels:
10-21-2018
09:09 AM
Hi,
I have had to replace a ISR 4331 which has a field notice replacement against it.
The router basically provides an IPSec Tunnel over a WAN circuit to another site while routing OSPF on top.
I installed the same version of software on the replacement router and copied and paste the original configuration (hostname changed to align with new company standards) and enabled the RTU licenses.
When connecting the new WAN circuit, the IPSec does not negotiate phase 1 and hence the tunnel does not come up. Both ends of the circuit and Tunnel are pingable. If I disable IPSec on the tunnel, the tunnel comes up.
#sh crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 186.17.230.1 186.17.230.2 MM_KEY_EXCH 1010 ACTIVE 186.17.230.1 186.17.230.2 MM_NO_STATE 1009 ACTIVE (deleted)
IPv6 Crypto ISAKMP SA
I thought that maybe the preshared key was possibly copied incorrectly, but it looks fine and performing a debug of IPSec we see that the preshared key looks OK.
*Oct 20 10:30:12.335 GMT: %SYS-5-CONFIG_I: Configured from console by console *Oct 20 10:30:13.096 GMT: ISAKMP: (0):SA request profile is (NULL) *Oct 20 10:30:13.096 GMT: ISAKMP: (0):Created a peer struct for 186.17.230.1, peer port 500 *Oct 20 10:30:13.096 GMT: ISAKMP: (0):New peer created peer = 0x7F07FF9E15B0 peer_handle = 0x8000000D *Oct 20 10:30:13.096 GMT: ISAKMP: (0):Locking peer struct 0x7F07FF9E15B0, refcount 1 for isakmp_initiator *Oct 20 10:30:13.096 GMT: ISAKMP: (0):local port 500, remote port 500 *Oct 20 10:30:13.096 GMT: ISAKMP: (0):set new node 0 to QM_IDLE *Oct 20 10:30:13.096 GMT: ISAKMP: (0):Find a dup sa in the avl tree during calling isadb_insert sa = 7F07F23EB648 *Oct 20 10:30:13.096 GMT: ISAKMP: (0):Can not start Aggressive mode, trying Main mode. *Oct 20 10:30:13.096 GMT: ISAKMP: (0):found peer pre-shared key matching 186.17.230.1 *Oct 20 10:30:13.096 GMT: ISAKMP: (0):constructed NAT-T vendor-rfc3947 ID *Oct 20 10:30:13.096 GMT: ISAKMP: (0):constructed NAT-T vendor-07 ID *Oct 20 10:30:13.096 GMT: ISAKMP: (0):constructed NAT-T vendor-03 ID *Oct 20 10:30:13.096 GMT: ISAKMP: (0):constructed NAT-T vendor-02 ID *Oct 20 10:30:13.096 GMT: ISAKMP: (0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM *Oct 20 10:30:13.096 GMT: ISAKMP: (0):Old State = IKE_READY New State = IKE_I_MM1 *Oct 20 10:30:13.096 GMT: ISAKMP: (0):beginning Main Mode exchange *Oct 20 10:30:13.096 GMT: ISAKMP-PAK: (0):sending packet to 186.17.230.1 my_port 500 peer_port 500 (I) MM_NO_STATE30:13.096 GMT: ISAKMP: (0):Sending an IKE IPv4 Packet. *Oct 20 10:30:13.103 GMT: ISAKMP-PAK: (0):received packet from 186.17.230.1 dport 500 sport 500 Global (I) MM_NO_STATE *Oct 20 10:30:13.103 GMT: ISAKMP: (0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Oct 20 10:30:13.103 GMT: ISAKMP: (0):Old State = IKE_I_MM1 New State = IKE_I_MM2 *Oct 20 10:30:13.103 GMT: ISAKMP: (0):processing SA payload. message ID = 0 *Oct 20 10:30:13.103 GMT: ISAKMP: (0):processing vendor id payload ISAKMP: (0):vendor ID seems Unity/DPD but major 69 mismatch *Oct 20 10:30:13.103 GMT: ISAKMP: (0):vendor ID is NAT-T RFC 3947 *Oct 20 10:30:13.103 GMT: ISAKMP: (0):found peer pre-shared key matching 186.17.230.1 *Oct 20 10:30:13.103 GMT: ISAKMP: (0):local preshared key found *Oct 20 10:30:13.103 GMT: ISAKMP: (0):Scanning profiles for xauth ... *Oct 20 10:30:13.103 GMT: ISAKMP: (0):Checking ISAKMP transform 1 against priority 10 policy CCBI_UKVAIDC1_RTP_RT_3#T: ISAKMP: (0): encryption 3DES-CBC *Oct 20 10:30:13.103 GMT: ISAKMP: (0): hash SHA *Oct 20 10:30:13.103 GMT: ISAKMP: (0): default group 1 *Oct 20 10:30:13.103 GMT: ISAKMP: (0): auth pre-share *Oct 20 10:30:13.103 GMT: ISAKMP: (0): life type in seconds *Oct 20 10:30:13.103 GMT: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80 *Oct 20 10:30:13.103 GMT: ISAKMP: (0):atts are acceptable. Next payload is 0 *Oct 20 10:30:13.103 GMT: ISAKMP: (0):Acceptable atts:actual life: 0 *Oct 20 10:30:13.103 GMT: ISAKMP: (0) Acceptable atts:life: 0 *Oct 20 10:30:13.103 GMT: ISAKMP: (0):Fill atts in sa vpi_length:4 *Oct 20 10:30:13.103 GMT: ISAKMP: (0):Fill atts in sa life_in_seconds:86400 *Oct 20 10:30:13.103 GMT: ISAKMP: (0):Returning Actual lifetime: 86400 *Oct 20 10:30:13.103 GMT: ISAKMP: (0):Started lifetime timer: 86400. *Oct 20 10:30:13.103 GMT: ISAKMP: (0):processing vendor id payload *Oct 20 10:30:13.103 GMT: ISAKMP: (0):vendor ID seems Unity/DPD but major 69 mismatch *Oct 20 10:30:13.103 GMT: ISAKMP: (0):vendor ID is NAT-T RFC 3947 *Oct 20 10:30:13.103 GMT: ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Oct 20 10:30:13.103 GMT: ISAKMP: (0):Old State = IKE_I_MM2 New State = IKE_I_MM2 *Oct 20 10:30:13.104 GMT: ISAKMP-PAK: (0):sending packet to 186.17.230.1 my_port 500 peer_port 500 (I) MM_SA_SETUP *Oct 20 10:30:13.104 GMT: ISAKMP: (0):Sending an IKE IPv4 Packet. *Oct 20 10:30:13.104 GMT: ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Oct 20 10:30:13.104 GMT: ISAKMP: (0):Old State = IKE_I_MM2 New State = IKE_I_MM3 *Oct 20 10:30:13.108 GMT: ISAKMP-PAK: (0):received packet from 186.17.230.1 dport 500 sport 500 Global (I) MM_SA_SETUP *Oct 20 10:30:13.108 GMT: ISAKMP: (0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Oct 20 10:30:13.108 GMT: ISAKMP: (0):Old State = IKE_I_MM3 New State = IKE_I_MM4 *Oct 20 10:30:13.108 GMT: ISAKMP: (0):processing KE payload. message ID = 0 *Oct 20 10:30:13.110 GMT: ISAKMP: (0):processing NONCE payload. message ID = 0 ISAKMP: (0):found peer pre-shared key matching 186.17.230.1 *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):processing vendor id payload *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):vendor ID is Unity *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):processing vendor id payload *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):vendor ID is DPD *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):processing vendor id payload *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):speaking to another IOS box! *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):#received payload type 20 *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):His hash no match - this node outside NAT *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):received payload type 20 *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):No NAT Found for self or peer *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):Old State = IKE_I_MM4 New State = IKE_I_MM4 *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):Send initial contact *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):SA is doing *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):pre-shared key authentication using id type ID_IPV4_ADDR *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):ID payload next-payload : 8 type : 1 *Oct 20 10:30:13.111 GMT: ISAKMP: (1007): address : 186.17.230.2 *Oct 20 10:30:13.111 GMT: ISAKMP: (1007): protocol : 17 port : 500 length : 12 *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):Total payload length: 12 *Oct 20 10:30:13.111 GMT: ISAKMP-PAK: (1007):sending packet to 186.17.230.1 my_port 500 peer_port 500 (I) MM_KEY_EXCH *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):Sending an IKE IPv4 Packet. *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Oct 20 10:30:13.111 GMT: ISAKMP: (1007):Old State = IKE_I_MM4 New State = IKE_I_MM5 *Oct 20 10:30:14.142 GMT: ISAKMP-PAK: (1007):received packet from 186.17.230.1 dport 500 sport 500 Global (I) MM_KEY_EXCH *Oct 20 10:30:14.143 GMT: ISAKMP: (1007):phase 1 packet is a duplicate of a previous packet. *Oct 20 10:30:14.143 GMT: ISAKMP: (1007):retransmitting due to retransmit phase 1 *Oct 20 10:30:14.642 GMT: ISAKMP: (1007):retransmitting phase 1 MM_KEY_EXCH... *Oct 20 10:30:14.642 GMT: ISAKMP: (1007):: incrementing error counter on sa, attempt 1 of 5: retransmit phase 1 *Oct 20 10:30:14.642 GMT: ISAKMP: (1007):retransmitting phase 1 MM_KEY_EXCH *Oct 20 10:30:14.642 GMT: ISAKMP-PAK: (1007):sending packet to 186.17.230.1 my_port 500 peer_port 500 (I) MM_KEY_EXCH *Oct 20 10:30:14.642 GMT: ISAKMP: (1007):Sending an IKE IPv4 Packet. *Oct 20 10:30:24.642 GMT: ISAKMP: (1007):retransmitting phase 1 MM_KEY_EXCH... *Oct 20 10:30:24.642 GMT: ISAKMP: (1007):: incrementing error counter on sa, attempt 2 of 5: retransmit phase 1 *Oct 20 10:30:24.642 GMT: ISAKMP: (1007):retransmitting phase 1 MM_KEY_EXCH *Oct 20 10:30:24.642 GMT: ISAKMP-PAK: (1007):sending packet to 186.17.230.1 my_port 500 peer_port 500 (I) MM_KEY_EXCH *Oct 20 10:30:24.642 GMT: ISAKMP: (1007):Sending an IKE IPv4 Packet. *Oct 20 10:30:25.143 GMT: ISAKMP-PAK: (1007):received packet from 186.17.230.1 dport 500 sport 500 Global (I) MM_KEY_EXCH *Oct 20 10:30:25.143 GMT: ISAKMP: (1007):phase 1 packet is a duplicate of a previous packet. *Oct 20 10:30:25.143 GMT: ISAKMP: (1007):retransmission skipped for phase 1 (time since last transmission 501) *Oct 20 10:30:25.891 GMT: ISAKMP-ERROR: (1007):ignoring request to send delete notify (sa not authenticated) src 186.17.230.2 dst 186.17.230.1 *Oct 20 10:30:34.643 GMT: ISAKMP: (1007):retransmitting phase 1 MM_KEY_EXCH... *Oct 20 10:30:34.643 GMT: ISAKMP: (1007):: incrementing error counter on sa, attempt 3 of 5: retransmit phase 1 *Oct 20 10:30:34.643 GMT: ISAKMP: (1007):retransmitting phase 1 MM_KEY_EXCH *Oct 20 10:30:34.643 GMT: ISAKMP-PAK: (1007):sending packet to 186.17.230.1 my_port 500 peer_port 500 (I) MM_KEY_EXCH *Oct 20 10:30:34.643 GMT: ISAKMP: (1007):Sending an IKE IPv4 Packet. *Oct 20 10:30:35.144 GMT: ISAKMP-PAK: (1007):received packet from 186.17.230.1 dport 500 sport 500 Global (I) MM_KEY_EXCH *Oct 20 10:30:35.145 GMT: ISAKMP: (1007):phase 1 packet is a duplicate of a previous packet. *Oct 20 10:30:35.145 GMT: ISAKMP: (1007):retransmission skipped for phase 1 (time since last transmission 502) *Oct 20 10:30:35.404 GMT: ISAKMP-ERROR: (1007):ignoring request to send delete notify (sa not authenticated) src 186.17.230.2 dst 186.17.230.1 *Oct 20 10:30:43.096 GMT: ISAKMP: (1007):set new node 0 to QM_IDLE *Oct 20 10:30:43.096 GMT: ISAKMP-ERROR: (1007):SA is still budding. Attached new ipsec request to it. (local 186.17.230.2, remote 186.17.230.1) *Oct 20 10:30:43.099 GMT: ISAKMP-ERROR: (0):Error while processing SA request: Failed to initialize SA *Oct 20 10:30:43.099 GMT: ISAKMP-ERROR: (0):Error while processing KMI message 0, error 2.
The IPSec config is below;
crypto isakmp policy 10 encr 3des authentication pre-share crypto isakmp key 6 TSWTc^DU\IXfcNhVUX\V^NdWfZEXT]\\dPIeJ_Z address 186.17.230.1 ! crypto ipsec security-association replay window-size 1024 ! crypto ipsec transform-set SET-TO-OB4F esp-3des esp-md5-hmac mode tunnel ! crypto ipsec profile VPN-TO-OB4F set transform-set SET-TO-OB4F set pfs group20 !
I've read other posts where folks have suggested changing the Keys to something completely new as they have become "corrupt"!
Any help appreciated.
Paul
... View more
- Tags:
- IPSec and Tunnel
Labels:
05-01-2018
06:24 AM
I agree the RST's are a bit of a worry, but Radius logs make it in OK.
If I look at the reports Operations>Reports>Device Administration> there are no reports to view!
The Switch tacacs debug shows the following;
May 1 13:21:31.357: TPLUS: Queuing AAA Authentication request 63 for processing May 1 13:21:31.357: TPLUS(0000003F) login timer started 1020 sec timeout May 1 13:21:31.357: TPLUS: processing authentication start request id 63 May 1 13:21:31.357: TPLUS: Authentication start packet created for 63(admin) May 1 13:21:31.357: TPLUS: Using server 10.0.0.101 May 1 13:21:31.357: TPLUS(0000003F)/0/NB_WAIT/B3B9038: Started 2 sec timeout May 1 13:21:31.360: TPLUS(0000003F)/0/NB_WAIT: socket event 2 May 1 13:21:31.360: TPLUS(0000003F)/0/NB_WAIT: wrote entire 37 bytes request May 1 13:21:31.360: TPLUS(0000003F)/0/READ: socket event 1 May 1 13:21:31.360: TPLUS(0000003F)/0/READ: Would block while reading May 1 13:21:31.364: TPLUS(0000003F)/0/READ: socket event 1 May 1 13:21:31.364: TPLUS(0000003F)/0/READ: read 0 bytes May 1 13:21:31.364: TPLUS(0000003F)/0/READ: socket event 1 May 1 13:21:31.364: TPLUS(0000003F)/0/READ: errno 254 May 1 13:21:31.364: TPLUS(0000003F)/0/B3B9038: Processing the reply packet May 1 13:21:31.381: TPLUS: Queuing AAA Authorization request 63 for processing May 1 13:21:31.381: TPLUS(0000003F) login timer started 1020 sec timeout May 1 13:21:31.381: TPLUS: processing authorization request id 63 May 1 13:21:31.381: TPLUS: Protocol set to None .....Skipping May 1 13:21:31.381: TPLUS: Sending AV service=shell May 1 13:21:31.381: TPLUS: Sending AV cmd* May 1 13:21:31.381: TPLUS: Authorization request created for 63(admin) May 1 13:21:31.381: TPLUS: using previously set server 10.0.0.101 from group ISE-TACACS May 1 13:21:31.385: TPLUS(0000003F)/0/NB_WAIT/B3B9038: Started 2 sec timeout May 1 13:21:31.385: TPLUS(0000003F)/0/NB_WAIT: socket event 2 May 1 13:21:31.388: TPLUS(0000003F)/0/NB_WAIT: wrote entire 56 bytes request May 1 13:21:31.388: TPLUS(0000003F)/0/READ: socket event 1 May 1 13:21:31.388: TPLUS(0000003F)/0/READ: Would block while reading May 1 13:21:31.392: TPLUS(0000003F)/0/READ: socket event 1 May 1 13:21:31.392: TPLUS(0000003F)/0/READ: errno 254 May 1 13:21:31.392: TPLUS(0000003F)/0/B3B9038: Processing the reply packet May 1 13:21:31.392: TPLUS: Queuing AAA Accounting request 63 for processing May 1 13:21:31.392: TPLUS: processing accounting request id 63 May 1 13:21:31.392: TPLUS: Sending AV task_id=527 May 1 13:21:31.392: TPLUS: Sending AV timezone=BST May 1 13:21:31.395: TPLUS: Sending AV service=shell May 1 13:21:31.395: TPLUS: Sending AV start_time=1525180891 May 1 13:21:31.395: TPLUS: Accounting request created for 63(admin) May 1 13:21:31.395: TPLUS: using previously set server 10.0.0.101 from group ISE-TACACS May 1 13:21:31.395: TPLUS(0000003F)/0/NB_WAIT/B3B9038: Started 2 sec timeout May 1 13:21:31.399: TPLUS(0000003F)/0/NB_WAIT: socket event 2 May 1 13:21:31.399: TPLUS(0000003F)/0/NB_WAIT: wrote entire 99 bytes request May 1 13:21:31.399: TPLUS(0000003F)/0/READ: socket event 1 May 1 13:21:31.399: TPLUS(0000003F)/0/READ: Would block while reading May 1 13:21:31.399: TPLUS(0000003F)/0/READ: socket event 1 May 1 13:21:31.399: TPLUS(0000003F)/0/READ: read 0 bytes May 1 13:21:31.402: TPLUS(0000003F)/0/READ: socket event 1 May 1 13:21:31.402: TPLUS(0000003F)/0/READ: errno 254 May 1 13:21:31.402: TPLUS(0000003F)/0/B3B9038: Processing the reply packet
... View more
05-01-2018
05:45 AM
Thanks for your reply Rich.
Yes I can confirm Device Admin is enabled.
Performing a packet trace and filtering port 49 (tcp.port == 49) which I have attached, we see port 49 hitting the ISE node (10.0.0105) and communication between the NAD (172.16.0.2)
I have had this working previously so don't know why it has now stopped!
... View more
05-01-2018
03:40 AM
Hello,
I'm running ISE 2.3 and trying to get TACACS working with a Switch and an ASA. The license and NAD configuration all look good. A aaa radius test works from the switch, while the tacacs test is user rejected.
I don't see any ISE logs for TACACS.
I am able to ping the ISE node from the NAD's and have double checked the keys.
Switch configuration; aaa group server tacacs+ ISE-TACACS server name apollo-ise ! aaa authentication login ISE-LOGIN group ISE-TACACS local aaa authentication enable default group ISE-TACACS enable aaa authorization console aaa authorization config-commands aaa authorization exec ISE-LOGIN group ISE-TACACS local if-authenticated aaa accounting update newinfo aaa accounting exec default start-stop group ISE-TACACS aaa accounting commands 1 default start-stop group ISE-TACACS aaa accounting commands 15 default start-stop group ISE-TACACS ! ip tacacs source-interface Loopback0 ! tacacs server apollo-ise address ipv4 10.0.0.101 key 7 03265A080D0B711C5C timeout 2 !
line vty 0 4 exec-timeout 15 0 authorization exec ISE-LOGIN logging synchronous login authentication ISE-LOGIN transport input ssh
Any help appreciated.
... View more
Labels:
01-09-2017
03:48 AM
Hi Darsan - thanks for your response.
The customers aim is to capture all the devices on the management VLAN100 that flow through it to the various network management stations etc. located on other subnets. The HSRP address for VLAN100 resides on the N7K pair.
The plan is once it is confirmed what devices are on VLAN 100 to apply a restricted ACL on each N7K only for these devices.
... View more
Created by
paul1202
in Other Data Center Subjects
in Other Data Center Subjects
12-15-2016
12:24 AM
12-15-2016
12:24 AM
Hi,
Please could someone let me know what the configuration would be to setup an Ethanalyzer session on a Nexus 7000.
We have a management VLAN running HSRP between 2 Nexus 7000 switches.
We simply want to capture and see all devices that traverse the management VLAN 100 (172.30.0.0/23) on the N7Ks.
The captured data should be sent to a file as I expected the capture needs to run for an extended time to ensure all devices are captured.
Thanks in advance.
... View more
Labels:
11-14-2016
05:04 AM
Hi All,
Can I use the Call Home feature so that if either of the devices were to "crash", the crashinfo files could be automatically uploaded to an external destination?
If not, could EEM perform the same task?
Thanks in advance.
... View more
Labels:
10-14-2016
06:42 AM
I have now found out that the c3650/c3850 switches do NOT support the show ip access-lists interface x/x command.
show platform acl definition and show auth sess int
... View more
10-14-2016
12:02 AM
Yes, as I thought, ip device tracking is enabled.
Test-Room-F#sh ip device tracking all Global IP Device Tracking for clients = Enabled Global IP Device Tracking Probe Count = 3 Global IP Device Tracking Probe Interval = 30 Global IP Device Tracking Probe Delay Interval = 0 ----------------------------------------------------------------------------------------------- IP Address MAC Address Vlan Interface Probe-Timeout State Source ----------------------------------------------------------------------------------------------- 172.30.7.183 0800.0f5e.7d81 102 GigabitEthernet1/0/26 30 ACTIVE ARP 172.30.28.171 88ae.1db7.3780 120 GigabitEthernet1/0/26 30 ACTIVE ARP 172.30.28.176 0018.1c01.964f 120 GigabitEthernet1/0/36 30 ACTIVE ARP 172.30.28.139 3863.bbaf.a9b9 120 GigabitEthernet1/0/45 30 INACTIVE ARP 172.30.28.200 84b2.6102.c840 120 GigabitEthernet1/0/1 30 ACTIVE ARP 172.30.4.49 0010.3603.2562 102 GigabitEthernet1/0/35 30 ACTIVE ARP 172.30.28.123 b05a.da3a.0b80 120 GigabitEthernet1/0/12 30 ACTIVE ARP
Total number interfaces enabled: 46 Enabled interfaces: Gi1/0/1, Gi1/0/2, Gi1/0/3, Gi1/0/4, Gi1/0/5, Gi1/0/6, Gi1/0/7, Gi1/0/8, Gi1/0/9, Gi1/0/10, Gi1/0/11, Gi1/0/12, Gi1/0/13, Gi1/0/14, Gi1/0/15, Gi1/0/16, Gi1/0/17, Gi1/0/18, Gi1/0/20, Gi1/0/21, Gi1/0/22, Gi1/0/23, Gi1/0/24, Gi1/0/25, Gi1/0/26, Gi1/0/27, Gi1/0/28, Gi1/0/29, Gi1/0/30, Gi1/0/31, Gi1/0/32, Gi1/0/33, Gi1/0/34, Gi1/0/35, Gi1/0/36, Gi1/0/37, Gi1/0/38, Gi1/0/39, Gi1/0/40, Gi1/0/41, Gi1/0/42, Gi1/0/43, Gi1/0/44, Gi1/0/45, Gi1/0/46, Gi1/0/47
... View more
10-13-2016
11:26 AM
From my original post you will see that it is just a simple permit ip any any as I just want to prove and see it is being downloaded successfully before being more specific.
Extended IP access list xACSACLx-IP-PERMIT_ALL_TRAFFIC-57452910 (per-user) 1 permit ip any any
... View more
09-13-2019
Hi All, A customer wants to authenticate Anyconnect VPN users from an
ASA using the client installed...
Created by
paul1202
in Data Center Switches
07-01-2019
07-01-2019
Thanks for the suggestion and yes you are correct that I had forgotten
that the same vpc domain-id w...
Created by
paul1202
in Data Center Switches
06-25-2019
06-25-2019
Here also is more STP info for one of the VLANs. VLAN0960Spanning tree
enabled protocol rstpRoot ID ...
Created by
paul1202
in Data Center Switches
06-25-2019
06-25-2019
Hi, I have dual N9K VPC pair of switches at 2 locations.I am using
VPC's, but for the inter-site con...
03-25-2019
Hi, We have a 2Mb inter-DC link connected to our Nexus 9K's -
C93180YC-FX, running 9.2.1. Does anyon...
11-03-2018
Hi Rick,So for the late reply.Yes, changing the master key resolved the
issue. The customer wasn't s...
10-29-2018
Thanks for your reply Rick. Speaking with the customer and doing further
checking, it appears there ...
10-23-2018
Thanks for your reply Marvin. I managed to lab the scenario (different
router platforms) and you are...
10-23-2018
Hi All, If I have an exisiting IPSec tunnel between 2 routers and one of
the routers has a hostname ...
10-21-2018
Hi, I have had to replace a ISR 4331 which has a field notice
replacement against it. The router bas...
05-01-2018
I agree the RST's are a bit of a worry, but Radius logs make it in OK.
If I look at the reports Oper...
05-01-2018
Thanks for your reply Rich. Yes I can confirm Device Admin is enabled.
Performing a packet trace and...
05-01-2018
Hello, I'm running ISE 2.3 and trying to get TACACS working with a
Switch and an ASA. The license an...
01-09-2017
Hi Darsan - thanks for your response. The customers aim is to capture
all the devices on the managem...
Public Statistics
| Date Registered | 03-13-2014 03:58 AM |
| Date Last Visited | 09-18-2019 01:01 AM |
| Total Messages Posted | 29 |
| Total Helpful Votes Received | 10 |
.jpg "Hall of Fame Master"){kind=icon}
