Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Tanveer Dewan
Tanveer Dewan
Beginner
A computer networking professional with close to 10 years of work experience. Proficient in enterprise design, security, implementation and support of enterprise and data center networks.
Recent Badges
Stats
Member since
06-08-2013
20
Posts
0
Helpful
0
Solutions
11-23-2015
11:38 AM
Hi Manish,
I am trying to compare the difference between two TX outputs with the difference between two RX outputs in the same output.
If RX is what is going into the DSP and TX is what is coming out of the DSP, shouldn't the number of packets going in and coming out be the same?
Tanveer
... View more
11-20-2015
02:12 AM
Hey!
I think you are right. check this out. Its referring to the 'redundancy' command and tunnel interface both.
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/m1/sec-m1-cr-book/sec-cr-r2.html#wp3201756504
... View more
11-20-2015
12:43 AM
Thanks for the response.
The document shows how to use HSRP with 'policy based vpn' where we use crypto acl to match interesting traffic. I on the otherhand want to use hsrp redundnacy along with 'route based vpn' where the interesting traffic is identified by a static route pointing to the tunnel interface.
... View more
Created by
Tanveer Dewan
in VPN and AnyConnect
in VPN and AnyConnect
11-18-2015
10:42 AM
11-18-2015
10:42 AM
I can find IPSec vpn redundancy using Policy-Based-VPN with HSRP.
Any document that provides route-based-vpn redundancy with HSRP?
... View more
Labels:
Created by
Tanveer Dewan
in VPN and AnyConnect
in VPN and AnyConnect
11-16-2015
01:27 PM
11-16-2015
01:27 PM
I am setting up a new site to site IPSec on Cisco IOS router.
The phase 1 and 2 both show up but the tunnel interface goes down in 4 seconds.
*Nov 16 17:16:45.400: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel2, changed state to up *Nov 16 17:16:48.388: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel2, changed state to down
Ikev2 and IPsec debugs do not tell a reason for this.
-------------------//---------------
Show output:
A#sh cry ikev2 sa IPv4 Crypto IKEv2 SA
Tunnel-id Local Remote fvrf/ivrf Status 6 2.2.2.2/4500 1.1.1.1/4500 none/none READY Encr: 3DES, Hash: SHA96, DH Grp:2, Auth sign: PSK, Auth verify: PSK Life/Active Time: 86400/184 sec
Tunnel-id Local Remote fvrf/ivrf Status 5 2.2.2.2/4500 1.1.1.1/4500 none/none READY Encr: 3DES, Hash: SHA96, DH Grp:2, Auth sign: PSK, Auth verify: PSK Life/Active Time: 86400/195 sec
Tunnel-id Local Remote fvrf/ivrf Status 11 2.2.2.2/4500 1.1.1.1/4500 none/none READY Encr: 3DES, Hash: SHA96, DH Grp:2, Auth sign: PSK, Auth verify: PSK Life/Active Time: 86400/137 sec
Tunnel-id Local Remote fvrf/ivrf Status 2 2.2.2.2/4500 1.1.1.1/4500 none/none READY Encr: 3DES, Hash: SHA96, DH Grp:2, Auth sign: PSK, Auth verify: PSK Life/Active Time: 86400/84 sec
A(config-if)#do sh cry ipsec sa | b unnel2 interface: Tunnel2 Crypto map tag: Tunnel2-head-0, local addr 2.2.2.2
protected vrf: (none) local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) current_peer 1.1.1.1 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0
local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1 plaintext mtu 1500, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 current outbound spi: 0x0(0) PFS (Y/N): N, DH group: none
-------------------//---------------
-------------------//---------------
Phase 2 debugs:
*Nov 14 14:15:25.350: IKEv2:(SESSION ID = 7,SA ID = 1):Received Packet [From 1.1.1.1:4500/To 2.2.2.2:4500/VRF i0:f0] Initiator SPI : DF20BCD830183163 - Responder SPI : A138DDE01C2C2E93 Message id: 662 IKEv2 INFORMATIONAL Exchange REQUEST Payload contents:
*Nov 14 14:15:25.350: IKEv2:(SESSION ID = 7,SA ID = 1):Received DPD/liveness query *Nov 14 14:15:25.350: IKEv2:(SESSION ID = 7,SA ID = 1):Building packet for encryption. *Nov 14 14:15:25.354: IKEv2:(SESSION ID = 7,SA ID = 1):Sending ACK to informational exchange
*Nov 14 14:15:25.354: IKEv2:(SESSION ID = 7,SA ID = 1):Sending Packet [To 1.1.1.1:4500/From 2.2.2.2:4500/VRF i0:f0] Initiator SPI : DF20BCD830183163 - Responder SPI : A138DDE01C2C2E93 Message id: 662 IKEv2 INFORMATIONAL Exchange RESPONSE Payload contents: ENCR
A#
*Nov 14 14:15:34.354: IKEv2:(SESSION ID = 7,SA ID = 1):Received Packet [From 1.1.1.1:4500/To 2.2.2.2:4500/VRF i0:f0] Initiator SPI : DF20BCD830183163 - Responder SPI : A138DDE01C2C2E93 Message id: 663 IKEv2 INFORMATIONAL Exchange REQUEST Payload contents:
*Nov 14 14:15:34.354: IKEv2:(SESSION ID = 7,SA ID = 1):Received DPD/liveness query *Nov 14 14:15:34.354: IKEv2:(SESSION ID = 7,SA ID = 1):Building packet for encryption. *Nov 14 14:15:34.358: IKEv2:(SESSION ID = 7,SA ID = 1):Sending ACK to informational exchange
*Nov 14 14:15:34.358: IKEv2:(SESSION ID = 7,SA ID = 1):Sending Packet [To 1.1.1.1:4500/From 2.2.2.2:4500/VRF i0:f0] Initiator SPI : DF20BCD830183163 - Responder SPI : A138DDE01C2C2E93 Message id: 663 IKEv2 INFORMATIONAL Exchange RESPONSE Payload contents: ENCR
-------------------//---------------
What would cause the tunnel interface to go down?
... View more
- Tags:
- ikev2
- ios router
- ipsec
Labels:
11-06-2015
03:41 AM
Hi Poonguzhali,
I have been reading that ASR Firewall Stateful Interchassis Redundancy does not support:
LAN and WAN scenarios are not supported.
LAN and MESH scenarios are not supported.
But I don't find any clarity on what exactly these scenaros are. Can you please give some details?
... View more
10-27-2015
03:52 AM
Hi, Can some please point me to the Cisco support forum usage guidelines and regulations? Regards, Tanveer Dewan Spooster IT Services
... View more
- Tags:
- cisco_forums
Labels:
03-08-2014
05:35 AM
When you say ' the ASA does not allow new network access sessions' functionality.in the ASA, what sessions are you talking about? Or am i missing something?
... View more
03-05-2014
06:53 AM
Since my aim is to be able to test all the possible features that I can, I am going to go for a 2960 'LAN Base' model. I am looking at the datasheet but am not able narrow down to the cheapest ones that can provide the features mentioned in my original post. I didn't realize Cisco has soooooo many models in this lineup. There should be a tool to help select models based on features one needs. Is there one? :-) Could you please give me the starting range in 'LAN Base'? Thanks!
... View more
02-28-2014
09:59 AM
Hi Tom, After reading the docs, the 300, 500 and ESW2 series seem to not run IOS. Also, it looks like that cisco wants/uses IOS and has completly moved away from CatOS. Therefor I want to be future proof and get a switch that runs IOS natively. Is the 2960 series what I should be looking at? Is is the cheapest of all that run IOS? Thanks!
... View more
02-28-2014
02:33 AM
Hi, I need to buy an entry level switch with the following features: qos configuration security features like port security, ACLs, NAC, IBNS layer 3 featureset may or may not be modular at least 24 ports at least 6 POE ports Please suggest the low cost model that is not end of sale.
... View more
Labels:
06-08-2013
10:51 AM
I am presuming you have also check the duplex settings on the lan interface of the ASA. is the problem only betwen dmz and lan? how's dmz to internet and lan to internet traffic? check cpu utilization memory utilization how many nat translations do you see at the time of copying files? 'show xlate' is the reverse lookup working fine for the servers in question?
... View more
Created by
Tanveer Dewan
in Switching
in Switching
06-08-2013
10:29 AM
06-08-2013
10:29 AM
Hi Chanchal, there can be a number of reasons for slow browsing. i think i have some idea about your setup but the information is very limited. You can try to bypass the ASA for a test client and check if that makes a difference. Or go through this link to check if the ASA is the cause: http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080b8e100.shtml A lot of times slow speed is because of slow name resolution. To verify that, you can check this article about DNS server to speed up page load. It would be best if you share your findings after going through the ASA troubleshooting link above and we can take it from there. Tanveer
... View more
11-23-2015
Hi Manish, I am trying to compare the difference between two TX outputs
with the difference between ...
11-20-2015
Hey! I think you are right. check this out. Its referring to the
'redundancy' command and tunnel int...
11-20-2015
Thanks for the response. The document shows how to use HSRP with 'policy
based vpn' where we use cry...
Created by
Tanveer Dewan
in VPN and AnyConnect
11-18-2015
11-18-2015
I can find IPSec vpn redundancy using Policy-Based-VPN with HSRP. Any
document that provides route-b...
Created by
Tanveer Dewan
in VPN and AnyConnect
11-16-2015
11-16-2015
I am setting up a new site to site IPSec on Cisco IOS router. The phase
1 and 2 both show up but the...
11-06-2015
Hi Poonguzhali, I have been reading that ASR Firewall Stateful
Interchassis Redundancy does not supp...
10-27-2015
Hi, Can some please point me to the Cisco support forum usage guidelines
and regulations? Regards,Ta...
03-08-2014
When you say 'the ASA does not allow new network access sessions'
functionality.in the ASA, what ses...
03-05-2014
Since my aim is to be able to test all the possible features that I can,
I am going to go for a 2960...
02-28-2014
Hi Tom,After reading the docs, the 300, 500 and ESW2 series seem to not
run IOS. Also, it looks like...
02-28-2014
Hi,I need to buy an entry level switch with the following features:qos
configurationsecurity feature...
06-08-2013
I am presuming you have also check the duplex settings on the lan
interface of the ASA. is the probl...
Created by
Tanveer Dewan
in Switching
06-08-2013
06-08-2013
Hi Chanchal,there can be a number of reasons for slow browsing. i think
i have some idea about your ...
Public Statistics
| Date Registered | 06-08-2013 10:16 AM |
| Date Last Visited | 10-15-2017 09:10 AM |
| Total Messages Posted | 20 |
