Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About dfreemire
Stats
Member since
08-31-2006
27
Posts
5
Helpful
0
Solutions
Created by
dfreemire
in Wireless Security and Network Management
in Wireless Security and Network Management
10-18-2019
09:15 AM
10-18-2019
09:15 AM
I was searching for the same thing and found this post. I realize it is old but I did find an option to get antenna information from Prime. I'm posting it for future travelers looking for the same thing. I couldn't find a report that includes antenna information but I did discover that it can easily be retrieved with a simple API call. You have to have a local account in Prime with access to the "NBI Read" group. There are Cisco DevNet instructions for configuring that here: https://solutionpartner.cisco.com/media/prime-infrastructure/api-reference/szier-m8-106.cisco.com/webacs/api/v1/index.html - Select "Tutorials." Then, all you have to do is run a cURL command. cURL (or just curl) is a command line utility. I'm pretty sure it comes standard in linux and macos. Curl is also available for Windows if you look around. Otherwise, you can install Postman. It is a free gui app that does API calls. The curl command is: curl -k "https://<username>:<password>@<prime server>/webacs/api/v1/data/RadioDetails?.full=true" The Prime API defaults to a maximum of 100 results. You can change that by adding &maxResults=250" at the end (or any number). The tutorial goes over paging, filtering and sorting as well. With APIs you can do more than query for information. For example, you can add or delete access points. If you can write scripts, you can do just about anything. There are lots of examples in DevNet and at github. Have fun Scott
... View more
04-18-2017
07:59 AM
Have you considered (or will this work) with ASA firewall configurations?
-Scott
... View more
03-24-2015
01:25 PM
Ok, I have it now. I only looked at the size of the various protocol sections. I didn't look at only the syslog message by itself. Those numbers are the payload. Just the syslog message without any protocol information. Thank you very much.
... View more
03-20-2015
07:03 AM
I have captured some syslog output from my ASA5585-SSP-40 running 9.1(5)19 code. The basic show command results in output that shows the source and destination IPs, each with .514 appended. This seems right because syslog is transmitted UDP/514. What I don't understand is the "udp 143" and "udp 166" at the end of these two lines. The rest of the capture has more, seemingly random, numbers at the end as well.
fw3-cloudsys-ash1/act# sh capture syslog-tst3
4294 packets captured
1: 15:36:39.245852 802.1Q vlan#2050 P0 10.30.30.30.514 > 10.20.20.20.514: udp 143
2: 15:36:39.245852 802.1Q vlan#2050 P0 10.30.30.30.514 > 10.20.20.20.514: udp 166
fw3-cloudsys-ash1/act# sh capture syslog-tst3 detail
4294 packets captured
1: 15:36:39.245852 f4cf.e200.3d72 0000.0c07.ac64 0x8100 Length: 189
802.1Q vlan#2050 P0 10.64.4.131.514 > 10.74.80.84.514: [udp sum ok] udp 143 (ttl 255, id 28239)
2: 15:36:39.245852 f4cf.e200.3d72 0000.0c07.ac64 0x8100 Length: 212
802.1Q vlan#2050 P0 10.64.4.131.514 > 10.74.80.84.514: [udp sum ok] udp 166 (ttl 255, id 15063)
I then exported the capture and looked at it with Wireshark. Those numbers, 143 & 166, do not appear anywhere in frames 1 and 2. The overall packet length of packet 1 is 189. The length of the UDP datagram is 151.
What is that output telling me? What is that last field in the ASA CLI terminal output?
Thank you
... View more
Labels:
Created by
dfreemire
in VPN and AnyConnect
in VPN and AnyConnect
03-07-2013
01:40 PM
03-07-2013
01:40 PM
I have WebEx Connect Client v7.2.0 Build 16843 and it has been working fine from the office. I can also connect just fine when I am connected to my home Internet service. If I connect to my home Internet, then use AnyConnect to connect to my office first, I then cannot login to WebEx. It tries for a while and then says "Lost connection to server. Please try to sign in again." I am running Windows 7 Enterprise SP1 64-bit on a Lenovo T420 with an Intel Core i7-2620M CPU If I connect to my home Internet, then login to WebEx first, and then connect to the office with AnyConnect, everything works fine. I have tried this with AnyConnect v2.5.3041 and AnyConnect Secure Mobility Client v3.1.02040. I am a network engineer so I did some captures and discovered the following: When logging in while connected only to the Internet the WebEx Client makes connections to three WebEx IPs: First it connects to 66..163.36.139 with HTTPS multiple times. Then it connects to 66.163.36.121 with HTTPS multiple times. Finally it connects to 66.163.36.80 with HTTPS multiple times. All of these connections use my wireless LAN adapter which has my private, home IP address (hidden, of course, by my home router NAT). Then I can use it normally When logging in while connected to the Internet and also running an AnyConnect VPN connection to my office (configured to allow local LAN access) the WebEx Client does this: First it connects to 66..163.36.139 with HTTPS multiple times from my wireless LAN adapter the same as above. Then it tries to connect to 66.163.36.121 with HTTPS but instead of going out using my wireless LAN adapter it tries to use the AnyConnect connection which has a different IP assigned to it by my office ASA firewall. This connection attempt never gets a response because my office firewall does not want to do a hairpin and provide an Internet connection. Now the WebEx Client says it Lost Connection to Server. The interface it tries to use is called different things depending on where you look at it: WireShark: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64 Windows Network Connections: Cisco AnyConnect Secure Mobility Client Connection ipconfig: Ethernet adapter Local Area Connection 6: Any ideas would be much appreciated. Thanks, Scott
... View more
- Tags:
- anyconnect
- asa
- webex
Labels:
Created by
dfreemire
in Policy and Access
in Policy and Access
10-05-2011
03:45 PM
10-05-2011
03:45 PM
I'm thinking that maybe it can't be done. I was trying to have the AP require a user level login and then require a second "enable" password for enable privileges - with "straight to enable" not possible from the initial login. Here are some more attempts: (p1 = user with default privileges, p15 = user defined with privilege 15) (step up = can authenticate when some gui links result in secondary login dialog) aaa authentication login default local ip http server no ip http secure-server ---Only allows login with no login name, just enable pwd--- aaa authentication login default local ip http server ip http authentication local ---Allows login with p1 or p15. Only p15 works for step-up--- aaa authorization exec http1 if-authenticated aaa authorization commands 15 http1 local ip http server ip http authentication aaa exec-authorization http1 ---Allows login with p1 or p15 user but no step-up if p1--- aaa authentication login default local aaa authorization exec default local aaa authorization exec http1 local aaa authorization commands 15 http1 local ip http server ip http authentication aaa exec-authorization http1 ---Allows login with p1 or p15 user but no step-up if p1--- aaa authentication login http1 enable aaa authorization exec http1 local aaa authorization commands 15 http1 local ip http server ip http authentication aaa login-authentication http1 ip http authentication aaa command-authorization 15 http1 no ip http secure-server ---Allows login with p1 or p15 only if using enable pw but no step-up if p1---
... View more
Created by
dfreemire
in Policy and Access
in Policy and Access
10-05-2011
10:24 AM
10-05-2011
10:24 AM
In CLI we have users log in at priv 1 and use "enable" to increase privilege and do configurations. This allows "accounting" of command history. On the AIR-AP1121G-A-K9 (12.3(8)JED1) I cannot duplicate this for http login. I can log in as a user at priv 1. When I try to go to a privileged link like "Security" I get prompted for a second login/pw. Nothing works here unless I have a second user defined at priv 15 and enter that login/pw. The problem is - that login/pw can be used to log in via http in the first place which bypasses accounting of the actual user. It also allows login to the CLI at priv 15 which I cannot permit. To test I'm trying to use the most simple tests. No https, no radius, etc. After extensive reading of documens and forums I am using this: username test1 secret 5 abcdxxx username test2 privilege 15 secret 5 efghxxx enable secret 5 ijklxxx aaa new-model <--omit wireless stuff--> aaa authentication login default local aaa authorization exec default local aaa authentication login HTTPonly local aaa authorization exec HTTPonly local aaa authorization commands 15 HTTPonly local aaa cache profile admin_cache all aaa session-id common ip http server ip http authentication aaa login-authentication HTTPonly ip http authentication aaa exec-authorization HTTPonly ip http secure-server
... View more
Labels:
08-11-2011
10:56 AM
In case anyone is interested - I did a reload of the standby Supervisor and redundancy remained sso. I then failed over (which worked well), and did a reload of the "new" standby Supervisor. When this was complete the sh mls cef maximum-routes value HAD NOT CHANGED. The instructions that I just got from TAC are "Physically pull the standby Supervisor, reboot the remaining Supervisor, physically pull the remaining Supervisor (I don't know what the switch does now), re-insert the original standby Supervisor, after it boots up check to see if table has new value - otherwise reboot this Supervisor, re-insert the original active Supervisor, double-check that the table is now the right size. This is not cool. I'm stuck between not being able to get such a large maintenance window and running with " Current IPv4 FIB exception state = TRUE" and worrying about a crash. (Note: Switch hasn't crashed due to table exception since I upgraded to 1G of RAM but this is still not a good condition). I'm now planning to combine this table expansion with an IOS upgrade so as to take full advantage of the required mega-reboot. I hope that doesn't overly confuse the Supervisors. -Scott
... View more
07-20-2011
12:18 PM
Thank you for your response. This is very close to what I was looking for. In fact it may lead me to the answer. My issue is that I need to do a Lot more preparation for a failover where the switchport modules get reset than I do for one where they don't. According to the doc that you referenced: "Note: In middle of the software upgrade procedure, the operational redundancy mode is RPR. This is evident from the show redundancy states command output shown in step 12. In RPR redundancy, during switchover, all switching modules are powered on again. So there is be a few minutes of downtime. During normal switchovers, if the operational redundancy is SSO, the installed switching modules are not reloaded, as both the startup and running config are synchronized continually from active to standby supervisor engine. The new active supervisor engine uses the current configuration." So, I know that when I change my IOS the switch will reset all of the switchport modules. In my current situation all I have done is to change the mls cef maximum-routes value. I guess what I'll have to do is to look at show module and show redundancy after rebooting the standby supervisor. If the new value taking effect upon reboot causes it to drop into RPR mode then I am stuck with that. If it stays in SSO then I get to do an easy failover. -Scott
... View more
07-07-2011
01:00 PM
When I entered the command the response was like "New value will take effect upon reboot." Can I reboot the standby Supervisor and then fail over without the switch module interfaces all resetting? Single Chassis, Dual Sup720, MSFC3, PFC3, IOS Version 12.2(33)SXH4. Thanks, Scott
... View more
Labels:
Created by
dfreemire
in VPN and AnyConnect
in VPN and AnyConnect
06-14-2011
09:11 AM
06-14-2011
09:11 AM
Are you using the same SSL Certificate for encryption? 1024 vs. 2048 bit could make some difference. -Scott
... View more
Created by
dfreemire
in VPN and AnyConnect
in VPN and AnyConnect
06-14-2011
08:01 AM
06-14-2011
08:01 AM
I think you nailed it. I have an existing tunnel-group for IPSec VPN Clients and I'm creating a second for migrating to AnyConnect. Thank you very much.
... View more
Created by
dfreemire
in VPN and AnyConnect
in VPN and AnyConnect
06-13-2011
11:26 AM
06-13-2011
11:26 AM
Googled and searched all over but this one is hard to phrase and I struck out.
... View more
Labels:
Created by
dfreemire
in IP Telephony and Phones
in IP Telephony and Phones
12-23-2010
03:04 PM
12-23-2010
03:04 PM
I am configuring call-manager-fallback on a 1760 router (12.4(12)). The router seems to be able to handle 30 ephones and 150 directory numbers. I have about 100 phones at my remote site (7940's) so I can't serve them all. How do I define which phones are allowed to register and which ones are not? This is what I have so far: call-manager-fallback secondary-dialtone 9 max-conferences 8 gain -6 limit-dn 7940 2 limit-dn 7960 4 ip source-address 172.16.53.21 port 2000 max-ephones 30 max-dn 150 default-destination 4300
... View more
Labels:
09-01-2010
08:04 AM
Cisco has two part numbers for the 1 GB memory upgrades for the Sup-720: MEM-MSFC3-1GB= (RP) and MEM-Sup720-SP-1GB= (SP) but they look identical to me. Are they actually the same part? Can they be interchanged?
... View more
Labels:
Created by
dfreemire
in Wireless Security and Network Management
10-18-2019
10-18-2019
I was searching for the same thing and found this post. I realize it is
old but I did find an option...
03-24-2015
Ok, I have it now. I only looked at the size of the various protocol
sections. I didn't look at only...
Created by
dfreemire
in VPN and AnyConnect
03-07-2013
03-07-2013
I have WebEx Connect Client v7.2.0 Build 16843 and it has been working
fine from the office. I can a...
Created by
dfreemire
in Collaboration Applications
03-07-2013
03-07-2013
I have WebEx Connect Client v7.2.0 Build 16843 and it has been working
fine from the office. I can a...
Created by
dfreemire
in Policy and Access
10-05-2011
10-05-2011
I'm thinking that maybe it can't be done. I was trying to have the AP
require a user level login and...
Created by
dfreemire
in Policy and Access
10-05-2011
10-05-2011
In CLI we have users log in at priv 1 and use "enable" to increase
privilege and do configurations. ...
06-14-2011
Are you using the same SSL Certificate for encryption? 1024 vs. 2048 bit
could make some difference....
Created by
dfreemire
in VPN and AnyConnect
06-14-2011
06-14-2011
I think you nailed it. I have an existing tunnel-group for IPSec VPN
Clients and I'm creating a seco...
Created by
dfreemire
in VPN and AnyConnect
06-13-2011
06-13-2011
Googled and searched all over but this one is hard to phrase and I
struck out.
Public Statistics
| Date Registered | 08-31-2006 01:30 PM |
| Date Last Visited | 10-25-2019 12:02 AM |
| Total Messages Posted | 27 |
| Total Helpful Votes Received | 5 |
.jpg "VIP Mentor"){kind=icon}
