Yes,  we changed password.  But I can not delete the nhrp username.  ... View more

I attached the router configuration. This is a branch office router.  Main configuration is VPN. Current configuration : 7843 bytes ! ! D version 15.1 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! ! boot-start-marker boot system tftp c2801-advipservicesk9-mz.151-4.M8.bin 255.255.255.255 boot-end-marker ! ! ! no aaa new-model ! crypto pki token default removal timeout 0 !         !         dot11 syslog ip source-route !         !         no ip dhcp use vrf connected ip dhcp excluded-address xxx ip dhcp excluded-address xx ip dhcp excluded-address xx ip dhcp excluded-address xx !         ip dhcp pool LAN-POOL  network xxx 255.255.255.0  default-router xxx  dns-server xxx !         !         !         ip cef    no ip domain lookup ip domain name xxxx no ipv6 cef !         multilink bundle-name authenticated !         !         !         !         password encryption aes !         !         voice service pots !         voice service voip !         !         !         !         !         voice-card 0 !         !         !         license udi pid CISCO2801 sn xxx username nhrp privilege 15 secret 5 $1$THBb$x1vTVwl0Kdf5BDA/hCW57oS1   Someone created this username   !         redundancy !         !         ip ssh version 2 !         crypto keyring DMVPNKEYRING    pre-shared-key address xxxxxx key 6 !         crypto isakmp policy 30  encr aes 256  hash sha256  authentication pre-share  group 20  lifetime 3600 !         crypto isakmp policy 103  encr aes 256  authentication pre-share  group 2  !         crypto isakmp policy 104  encr aes 256  authentication pre-share  group 5  !         crypto isakmp policy 105  encr 3des  authentication pre-share  group 5  !         crypto isakmp policy 107  encr 3des  authentication pre-share  group 2  !         crypto isakmp policy 108  encr 3des  hash md5  authentication pre-share  group 5  crypto isakmp keepalive 10 periodic crypto isakmp profile DMVPN_ISAKMP    keyrinxxxx    match identity address xxxx!         !         crypto ipsec transform-set iamas_vpn esp-aes 256 esp-sha-hmac crypto ipsec transform-set SEC_TRANS1 esp-aes 256 esp-sha256-hmac ! Transform runs with reduced performance !         crypto ipsec profile SEC_PROFILE1  set transform-set SEC_TRANS1  set pfs group20  set isakmp-profile DMVPN_ISAKMP !         !         crypto ipsec client ezvpn ez  connect auto  group axxxx key 6 xxxx  mode network-extension  peer xxxxxx  username xxxx password 6 yyyy !         !         !         !         !         !         !         interface Tunnel30  bandwidth 10000  ip address xxxx  no ip redirects  ip mtu 1400  ip hello-interval eigrp 30 30  ip hold-time eigrp 30 120  ip nhrp authentication xxxxx  ip nhrp map multicast dynamic  ip nhrp map xxxxx  ip nhrp map multicast xxxx  ip nhrp map xxxx  ip nhrp map multicast xxxx  ip nhrp network-id 9  ip nhrp holdtime 600  ip nhrp nhs xxxx  ip nhrp nhs xxxx  ip nhrp registration no-unique  ip tcp adjust-mss 1360  ntp broadcast client  tunnel source xx  tunnel mode gre multipoint  tunnel key xxxxx  tunnel protection ipsec profile SEC_PROFILE1 !         interface FastEthernet0/0  no ip address  duplex auto  speed auto  pppoe enable group global  pppoe-client dial-pool-number 1 !         interface FastEthernet0/1  ip address xxxx 255.255.255.0  ip nat inside  ip nat enable  ip virtual-reassembly in  ip tcp adjust-mss 1400  duplex auto  speed auto  crypto ipsec client ezvpn ez inside !          interface Dialer1  ip address negotiated  ip access-group 110 in  ip mtu 1492  ip nat outside  ip nat enable  ip virtual-reassembly in  encapsulation ppp  dialer pool 1  dialer-group 1  ppp chap hostname xxxx  ppp chap password 7 xxxx  ppp pap sent-username xxxx password 7 xxxx !         !         router eigrp 10  network xxxx  0 0.0.0.255  network xxxxx 0.0.0.127 !         ip forward-protocol nd !         !         no ip http server no ip http secure-server ip nat inside source route-map nat interface Dialer1 overload ip route 0.0.0.0 0.0.0.0 x !         ip access-list extended xxxxx  permit ip host x.x.x  1x..x.x.x .0 0.0.0.255  permit ip host xxxxx x.x.6.0 0.0.0.255  permit ip host xxxx host y  permit ip host xxxx host y  permit ip host x.xxx host y  permit ip host xxxxx host y  permit ip host xxxx host y  permit ip host xxxxx host y !         access-list 110 permit ip host xxxx any access-list 110 permit ip host xxxxx any access-list 110 deny   tcp any any eq 1720 access-list 110 deny   tcp any any eq 1719 access-list 110 deny   tcp any any eq 1718 access-list 110 deny   tcp any any eq 2099 access-list 110 deny   udp any any eq 1720 access-list 110 deny   udp any any eq 1719 access-list 110 deny   udp any any eq 1718 access-list 110 deny   udp any any eq 2099 access-list 110 deny   tcp any any eq telnet access-list 110 deny   tcp any any eq www access-list 110 deny   tcp any any eq 22 access-list 110 permit ip any any access-list 135 deny   ip xxxx 0.0.0.255 host 10.200.200.22 access-list 135 deny   ip host xxx 172.16.0.0 0.0.255.255 access-list 135 deny   ip host xxx 10.10.0.0 0.0.255.255 access-list 135 deny   ip host xxx host 10.200.200.20 access-list 135 deny   ip host x host 10.200.200.21 access-list 135 deny   ip host x any access-list 135 deny   ip host x any access-list 135 deny   ip host x yyy access-list 135 deny   ip host x xxx access-list 135 deny   ip host x xx access-list 135 deny   ip host x xxxx access-list 135 deny   ip host x xxx access-list 135 deny   ip host x xxxxx access-list 135 deny   ip host x xxx access-list 135 deny   ip host x xxxx access-list 135 deny   ip host x any access-list 135 permit ip x 0.0.0.255 any dialer-list 1 protocol ip permit !         !         !         !         route-map nat permit 10  match ip address 135 !         !         !         control-plane !         !         voice-port 0/0/0 !         voice-port 0/0/1 !         voice-port 0/0/2 !         voice-port 0/0/3 !         ccm-manager redundant-host xxxxx ccm-manager mgcp no ccm-manager fax protocol cisco ccm-manager music-on-hold ccm-manager config server xxxx  ccm-manager config !         mgcp      mgcp call-agent x.x.x.x  2427 service-type mgcp mgcp rtp unreachable timeout 1000 action notify mgcp modem passthrough voip mode nse mgcp package-capability rtp-package mgcp package-capability sst-package mgcp package-capability pre-package no mgcp package-capability res-package no mgcp timer receive-rtcp mgcp sdp simple mgcp fax t38 inhibit mgcp bind control source-interface x mgcp bind media source-interface x !         mgcp profile default !         !         dial-peer voice 14 pots  service mgcpapp  port 0/0/0 !         dial-peer voice 34 pots  service mgcpapp  port 0/0/1 !         dial-peer voice 54 pots  service mgcpapp  port 0/0/2 !         dial-peer voice 7 pots  service mgcpapp  port 0/0/3 !         dial-peer voice 9994001 pots  service mgcpapp  port 0/0/1 !         dial-peer voice 9994003 pots  service mgcpapp  port 0/0/3 !         dial-peer voice 9949000 pots  service mgcpapp  port 0/0/0 !         dial-peer voice 999002 pots  service mgcpapp  port 0/0/2 !         !         !         !         alias exec c conf t !         line con 0  logging synchronous  login local line aux 0 line vty 0 4  login local  transport input ssh line vty 5 15  login local  transport input ssh !         scheduler allocate 20000 1000 ntp update-calendar end      ... View more

yes full recovery but active active. for example one server is active site2, one of services or application is active site1 and other services are active in site2.  but routers, asa is active standby.  ... View more

Thank you your helping.   When i connect only pc on that port of switch the authentication is OK(normal working). when i connect both of them the same port the phone is authenticate normaly. the pc want to authenticate but it can not. i think it is oouthorization problems. do you need ise configuration??   Pc: windows 7 Sw:Cisco IOS Software, C2960S Software (C2960S-UNIVERSALK9-M), Version 12.2(55)SE7, I can connect remotely the sites. i will send you the others information asap.   ... View more

please provide me any documentation how configure ip phone and behind the pc from ISE. i did not find any documentation. ... View more

interface GigabitEthernet1/0/48  switchport access vlan 10  switchport mode access  switchport voice vlan 14  ip access-group ACL-ALLOW in  authentication event fail action next-method  authentication event server dead action authorize vlan 20  authentication event server alive action reinitialize  authentication host-mode multi-auth  authentication open  authentication order dot1x mab  authentication priority dot1x mab  authentication port-control auto  authentication periodic  authentication timer reauthenticate server  authentication violation restrict  mab  dot1x pae authenticator  dot1x timeout tx-period 10  spanning-tree portfast   do you need ISE configuration?? ... View more

I also configurate that but the problem is the phone is authenticate successfully but the wired user want to authenticate but it can not. the switch configuration is same as your confiq. Can you provide me the any practice ise configuration. before it i have only wired user authentication and it is working normally. when i configure new aithentication and autherization profile for phone at this time the phone is authenticate normal but wired user not. my email address: educcna@gmail.com Thank for your helping. ... View more