Hi Carlo, As far as I know "ip nat outside destination" is not available. Destination keyword is only available on ip nat inside and is used for load-balancing. There are 2 types of nat : static and list ( acl and route-map ). The main difference between them is that static creates a bidirectional translation. This means that , unlinke the 'list' nat, the packet can be originated on any interface (outisde|inside). In your case you need to configure a static nat. IOS will DNAT in case of a packet arriving on the outside interface with the destination of Outside Global according to your nat statement Regards, Dan ... View more

Hi, You can have a look at this document : http://docwiki.cisco.com/wiki/IPv6_and_IPv4_Dual_Stack_on_a_Branch_Router_Configuration_Example Dan ... View more

Hi, The thing is that the trojan is initiating the traffic from inside , so there is no real use to filter the traffic from the outside to inside. A good think will be to restrict the users to some well known destination ports to the internet : tcp 80 , tcp 443 , tcp 21/20. A better way to offer internet access to the users is Proxy -  you can inspect and restrict the user access. Dan ... View more

Hi, I would try to exempt 1.1.1.4 from nat : no access-list 1 access-list 1 deny host 1.1.1.4 access-list 1 permit 1.1.1.0 0.0.0.255 Dan ... View more

Hi a ) If the requiremnet is to advertise to 100 ONLY AS 2 : ip as-path access-list 100 permit _2$ Permit AS2 , deny anything b ) If you have also other prefixes , but you want only to filter AS 1: ip as-path access-list 100 deny _1$ ip as-path access-list 100 permit .* Deny AS1, permit anything Either way apply the as-path acl on OUT to AS100. router bgp 200 neigh AS-100-NEI filter-list 100 out Dan ... View more

Hi, Yes it does support, ip sla. From Lan Base to Adv Ip Serv. Dan ... View more

Pete first of all Anyway if you want this traffic get nat-ed, it will not happend for sure with if you add the flow on nat exempt acl. Are you saying that I need to add a flow on nat exempt acl?  No, I am sayin that you should not add this traffic ( 10.100.8.0/24 ->10.100.1.0/24 ) on nat exemption. This is what I saw in your initial config : nat (vlan1) 0 access-list inside_outbound_nat0_acl nat (vlan2) 0 access-list inside_outbound_nat0_acl access-list inside_outbound_nat0_acl extended permit ip 10.100.8.0 255.255.255.0 10.100.1.0 255.255.255.0 access-list inside_outbound_nat0_acl extended permit ip 10.100.1.0 255.255.255.0 10.0.0.0 255.0.0.0 You must reconfigure your static statement: no static (vlan1,vlan2) 172.20.1.1 10.100.1.122 netmask 255.255.255.255 static (vlan1,vlan2) 50.50.50.50 10.100.1.122 netmask 255.255.255.255 Dan ... View more

Hi Pete, Please post : show run static show run route show access-list  inside_outbound_nat0_acl Anyway if you want this traffic get nat-ed, it will not happend for sure with if you add the flow on nat exempt acl. Dan ... View more

Duplicate ... View more

Hi Mark, Two applets , one shut , one no shut, both using cron timer.Shutdown ad 23:59 and un-shut at 08:59 event manager applet SHUT event timer cron cron-entry "59 23 * * *" action 1 cli command "en" action 2 cli command "conf t" action 3 cli command "int fa0/0" action 4 cli command "shut" event manager applet NO-SHUT event timer cron cron-entry "59 08 * * *" action 1 cli command "en" action 2 cli command "conf t" action 3 cli command "int fa0/0" action 4 cli command "no shut" Dan ... View more

Hi , You can use CBAC/IOS Firewall http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a0080094e8b.shtml Dan ... View more