About Stephen Carville

Stephen Carville · ‎05-18-2018

This was so simple I am still kicking myself over it. # conf t (config)# ip routing ^Z It all works now. When in the heck did Cisco stop turning on IP routing by default?

Stephen Carville · ‎05-17-2018

Someone elsewhere suggested the problem may be licensing. However they look OK to me: #show license right-to-use Slot# License Name Type Period left ---------------------------------------------------- 1 network-essentials Permanent Lifetime 1 network-advantage Permanent Lifetime 1 dna-advantage Subscription CSSM Managed ---------------------------------------------------- License Level on Reboot: network-advantage+dna-advantage Subscription Slot# License Name Type Period left ---------------------------------------------------- 2 network-essentials Permanent Lifetime 2 network-advantage Permanent Lifetime 2 dna-advantage Subscription CSSM Managed ---------------------------------------------------- License Level on Reboot: network-advantage+dna-advantage Subscription Slot# License Name Type Period left ---------------------------------------------------- 3 network-essentials Permanent Lifetime 3 network-advantage Permanent Lifetime 3 dna-advantage Subscription CSSM Managed ---------------------------------------------------- License Level on Reboot: network-advantage+dna-advantage Subscription OTOH, I do not know much about the so-called "smart" licensing.

Stephen Carville · ‎05-17-2018

The laptop is picking up a correct configuration for the site. Most of the local addresses here are 10.212.X.X but the new site will be 10.214.X.X and I typed 212 in a few place I meant 214. Sorry for the confusion. I edited the original post to fix that error. JIC, Lat night I also shut down the stack (it's still in the lab) and scanned for any 10.214.0.0/16 addresses that might be laying around the LAN. I found none so I guess it is not a duplicate IP.

Stephen Carville · ‎05-16-2018

I have a new stack of three 9300s that seem to route traffic in some very confusing ways. I can reach the vlan address on the switch (10.214.184.1) from my workstation: # mtr -rnc 10 10.214.184.1 HOST: c00464.lereta.com Loss% Snt Last Avg Best Wrst StDev 1. 198.204.114.232 0.0% 10 0.3 0.4 0.3 0.6 0.1 2. 10.212.3.178 0.0% 10 0.2 0.3 0.2 0.4 0.1 3. 10.214.184.1 0.0% 10 47.8 46.7 33.0 65.3 9.4 Next I plugged a laptop to the new stack and it got an address (10.214.184.50) from the DHCP server. However, when I try to traceroute to the laptop the traffic does not get there or the return packets are not getting through. # mtr -rnc 10 10.214.184.50 HOST: c00464.lereta.com Loss% Snt Last Avg Best Wrst StDev 1. 198.204.114.232 0.0% 10 0.3 26.4 0.3 261.7 82.7 2. 10.212.3.178 0.0% 10 0.3 0.3 0.2 0.3 0.0 3. ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 If I ping the laptop IP from the switch it works fine. # ping 10.212.184.50 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.212.184.50, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 40/46/56 ms If I scan the laptop IP things start to get really weird: # nmap -A 10.214.184.50 Starting Nmap 7.60 ( https://nmap.org ) at 2018-05-16 14:07 PDT Nmap scan report for 10.214.184.50 Host is up (0.055s latency). Not shown: 997 filtered ports PORT STATE SERVICE VERSION 80/tcp open http nginx |_http-server-header: nginx |_http-title: Site doesn't have a title (text/html). 443/tcp open ssl/http nginx |_http-server-header: nginx |_http-title: Site doesn't have a title (text/html). | ssl-cert: Subject: commonName=IOS-Self-Signed-Certificate-909702223 | Not valid before: 2018-05-11T23:07:54 |_Not valid after: 2020-01-01T00:00:00 |_ssl-date: TLS randomness does not represent time | tls-nextprotoneg: |_ http/1.1 8090/tcp open http nginx |_http-server-header: nginx |_http-title: 502 Bad Gateway Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|specialized|storage-misc Running (JUST GUESSING): Linux 3.X|4.X (91%), Crestron 2-Series (87%), HP embedded (85%) OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 cpe:/o:crestron:2_series cpe:/h:hp:p2000_g3 Aggressive OS guesses: Linux 3.2 - 4.8 (91%), Linux 3.10 - 4.8 (89%), Linux 3.18 (87%), Crestron XPanel control system (87%), Linux 3.16 (86%), HP P2000 G3 NAS device (85%) No exact OS matches for host (test conditions non-ideal). Network Distance: 3 hops TRACEROUTE (using port 80/tcp) HOP RTT ADDRESS 1 0.35 ms 198.204.114.232 2 0.34 ms mx400-01.lereta.net (10.212.3.178) 3 64.13 ms 10.214.184.50 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 27.81 seconds I am absolutely certain there is no web server at all on the laptop much less nginx. When I use a browser to reach out to 10.214.184.50 I get the web management interface for the switch stack! I can log in and everything. What I cannot do is connect to anything beyond the stack and that makes no sense at all to me. In the old days I could stack 3750s or 3850s, define some VLANs, set some routes, and everything worked. I cannot figure out what the 9300s do differently. (Some of the preformatted text above did not format clearly so I hope it is readable.)

Stephen Carville · ‎04-12-2018

That's what I thought. Thank you.

Stephen Carville · ‎04-12-2018

I received a spec sheet for a P2P VPN between an ASA 5585 and our ASA 5525 with the above requirement. AFAIK, it is not an option for the Cisco ASA. I think I've seen such an option for Checkpoint but, thankfully, we don't do Checkpoint here. OTOH, I could be wrong and would appreciate someone setting me straight.

Stephen Carville · ‎03-14-2018

@Florin Barhala wrote: I am also interested in this as we might migrate this year. I've only had it a few days but, so far, I am unimpressed. Even a simple change like blacklisting the IP of a CNC server requires redeploying the entire policy. That takes five to ten minutes. Don't get me started on the HTML 5 interface. What was Cisco thinking? Meantime can you share your current traceroute "config ". I am having some issues to make it work on my current ASAs. As I recall, on the ASA I first had to create an object list for the icmp types I wanted to accept from outside: object-group icmp-type icmp_permit description icmp types allowed icmp-object echo-reply icmp-object source-quench icmp-object time-exceeded icmp-object traceroute icmp-object unreachable Then on the outside interface acl I added: permit icmp any any object-group icmp_permit Finally, the global policy map had to be made aware of icmp policy-map global_policy class inspection_default <buncha stuff> inspect icmp inspect icmp error

Stephen Carville · ‎03-13-2018

I have a new set of Firepower 2130 appliances and a Management Center 1000. One of the differences between the 5525x and the Firepower is that some users can run traceroute, tracert or mtr and get useful information. Other users cannot get past their gateway. This worked correctly on the ASA 5525x but when the consultant did the conversion to the Firepower rules some weird stuff happened. Where is traceroute, etal set up? I know the process uses ICMP and/or UDP but just allowing those outbound has not cured the problem. Is there some inspection rule I need to create?

Stephen Carville · ‎01-03-2018

I finally figured it out. The OS on the firepower management console was 6.2.0 but the 2130a were 6.2.1. Apparently these are not compatible. I update the FMC to 6.2.2 and both 2130s registered.

Stephen Carville · ‎12-20-2017

I am trying to get a couple of Firepower 2130s registered with the management console. First, I added a pre-shared key: > configure manager add co-fpwr01.lereta.net <alpha-numeric key> When I tried to add the device it fails and, to top it off, the web interface on the 2130 now returns an error 503. I am guessing that somewhere along the line I crashed a process on the 2130 and I cannot get it back. Even a reboot didn't help. I hope this is fixable.

Stephen Carville · ‎11-27-2017

@Xavillon wrote: Hello, Could you give us a show runing configuration of N9K and 3850? Should be attached

Stephen Carville · ‎11-27-2017

@johnd2310 wrote: Hi, If you look in the switches, are you seeing any mac addresses? What version of code are you running on the switches? Thanks John co-nx9000a# show mac address-table Legend: * - primary entry, G - Gateway MAC, (R) - Routed MAC, O - Overlay MAC age - seconds since last seen,+ - primary entry using vPC Peer-Link, (T) - True, (F) - False, C - ControlPlane MAC VLAN MAC Address Type age Secure NTFY Ports ---------+-----------------+--------+---------+------+----+------------------ * 1 188b.9dc0.a0d8 dynamic 0 F F Eth1/1 * 1 5897.bd2b.7de0 dynamic 0 F F Eth1/1 G - 00a3.8e6d.08e7 static - F F sup-eth1(R) co-nx9000b# show mac address-table Legend: * - primary entry, G - Gateway MAC, (R) - Routed MAC, O - Overlay MAC age - seconds since last seen,+ - primary entry using vPC Peer-Link, (T) - True, (F) - False, C - ControlPlane MAC VLAN MAC Address Type age Secure NTFY Ports ---------+-----------------+--------+---------+------+----+------------------ * 1 188b.9dc0.a0d8 dynamic 0 F F Eth1/2 * 1 5897.bd2b.7de0 dynamic 0 F F Eth1/2 G - 00a3.8e6d.0987 static - F F sup-eth1(R) show version on both 9000s says: Software BIOS: version 07.56 NXOS: version 7.0(3)I5(1) BIOS compile time: 06/08/2016 NXOS image file is: bootflash:///nxos.7.0.3.I5.1.bin NXOS compile time: 10/29/2016 6:00:00 [10/29/2016 13:46:41]

Stephen Carville · ‎11-27-2017

@Georg Pauwen wrote: Hello, how are the 3850s connected to the NX9K, that is, which interfaces/adapters are you using ? Each switch has a ten Gig connections to one each of the NX-9000s 3850: Te1/1/3 connected trunk full 10G SFP-10GBase-SR Te1/1/4 connected trunk full 10G SFP-10GBase-SR nx9000a Eth1/6 co-3850d connected trunk full 10G 10Gbase-SR-S nx9000b Eth1/6 co-3850d connected trunk full 10G 10Gbase-SR-S

Stephen Carville · ‎11-22-2017

I have a 6509 attached to a pair of nx9000s via Ten Gig fiber which are in turn connected to four 3850s -- standalone, not stacked -- also by Ten Gig fiber. CDP shows that each device can see the next hop in the chain and VTP information propagates from the 6509 through the nx9000 to the 3850s. So far so good. My problem arises because no IP traffic seems to pass through through the nx9000s. In the diagram below, Node B and Node C can talk to each other as expected if they are on the same VLAN. However, neither can talk to Node A nor can A talk to B or C. By "not talk" I mean that a sniffer on A sees no IP packets at all from B or C. Similarly, a sniffer on B or C sees nothing from A. All of the connections between the switches are configured as trunks and appear to be working normally except for this puzzling lack of traffic. I guess there is some configuration required I just don't knew about yet but swlep me I cannot find it in the manuals.

Stephen Carville · ‎11-21-2017

It is supposed to be new but who knows. I see if I can get attached with a monitor

Date Registered	‎03-19-2013 04:19 PM
Date Last Visited	‎05-21-2018 04:42 AM
Total Messages Posted	74
Total Helpful Votes Received	25

Re: Cisco 9300 Routing Traffic Weirdly

Re: Cisco 9300 Routing Traffic Weirdly

Re: Cisco 9300 Routing Traffic Weirdly

Cisco 9300 Routing Traffic Weirdly

Re: Key Exchange For Subnets?

Key Exchange For Subnets?

Re: Traceroute, tracert, mtr and the Fi...

Traceroute, tracert, mtr and the Firepo...

Re: Firepower 2130 will not register wi...

Firepower 2130 will not register with m...

Re: IP traffic does not propagate throu...

Re: IP traffic does not propagate throu...

Re: IP traffic does not propagate throu...

IP traffic does not propagate through a...

Re: Firepower Management Console FMC 10...