Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Alexander Proskurnin
Stats
Member since
08-27-2010
36
Posts
0
Helpful
0
Solutions
Created by
Alexander Proskurnin
in Wireless Security and Network Management
in Wireless Security and Network Management
03-28-2019
03:23 AM
03-28-2019
03:23 AM
We don't know what can be done with ISE 'cause we don't have it :) but our 3rd party portal do cache users for configurable time but this is not enough. Here is what's happening: 1. new user connect to open wifi network 2. user completes identification on the portal and by redirect to 1.1.1.1/login.html gets authorized on the network 3. after some network activity user disconnects 4. now he may come next day or in a month and connect to wifi network 5. when this happens controller does not have state for this client and forward request to portal just to press "go to internet" button, so by default without some additional user actions in the browser there will be no internet access. It seems like I need to rethink about access to wifi network, because all those questions/problems comes from the willing to make one network for both guests and employees.
... View more
Created by
Alexander Proskurnin
in Wireless Security and Network Management
in Wireless Security and Network Management
03-28-2019
02:33 AM
03-28-2019
02:33 AM
>>> Interested to know the use case of why u need it different on a per user/user group. I use open network with captive portal and wanted to use Radius to make client idle timeout infinite, so once identified on the portal clients will forever be authorized. Something like sleeping client feature but it's also configured on the WLC per WLAN and can be maximum of 30 days.
... View more
Created by
Alexander Proskurnin
in Wireless Security and Network Management
in Wireless Security and Network Management
03-28-2019
12:17 AM
03-28-2019
12:17 AM
Hi, Haydn! ver 8.3.102.0 This command is available, but I need to override it by AVP from radius. (Cisco Controller) >config wlan usertimeout ? <seconds> Client Idle timeout(in seconds) on this WLAN. Range 0,15-100000 secs. 0 to disable
... View more
Created by
Alexander Proskurnin
in Wireless Security and Network Management
in Wireless Security and Network Management
03-27-2019
11:47 PM
03-27-2019
11:47 PM
Here the output from WLC. And it correctly recognizes AVPs: *radiusTransportThread: Mar 27 15:09:02.272: Packet contains 2 AVPs: *radiusTransportThread: Mar 27 15:09:02.272: AVP[01] Idle-Timeout.............................0x3b9aca14 (1000000020) (4 bytes) *radiusTransportThread: Mar 27 15:09:02.272: AVP[02] Session-Timeout..........................0x3b9aca14 (1000000020) (4 bytes) but the only option it overrides is sessionTimeout: *apfReceiveTask: Mar 27 15:09:02.273: 1c:cd:e5:3b:0c:c8 Override values for station 1c:cd:e5:3b:0c:c8 source: 2, valid bits: 0x100 qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: 1000000020 WLC still uses global idleTimeout 300 seconds.
... View more
Created by
Alexander Proskurnin
in Wireless Security and Network Management
in Wireless Security and Network Management
03-27-2019
08:06 AM
03-27-2019
08:06 AM
Hi all! I can't find any info about which AAA attributes are supported by WLC2504 (ver 8.3.102.0). Especially I'm interested in AVP Idle-Timeout. It seems like it's not supported but I search for a proof of it. Thanks in advance.
... View more
- Tags:
- aaa
Labels:
11-18-2016
11:29 AM
Sorry for my explanation. I mean why do we have command
switchport private - vlan host - association 100 202
and not
switchport private - vlan host - association 202
... View more
11-18-2016
07:02 AM
I wonder why when configuring pvlan feature we need to map secondary vlan to primary vlan 2 times.
sw(config)# vlan 201 sw(config-vlan)# private-vlan isolated sw(config)# vlan 202 sw(config-vlan)# private-vlan community sw(config-vlan)# vlan 100 sw(config-vlan)# private-vlan primary sw(config-vlan)# private-vlan association 201,202 sw(config-vllan)# interface fastethernet 0/24 sw(config-if)# switchport mode private-vlan promiscuous sw(config-if)# switchport private-vlan mapping 100 201,202 sw(config-if)# interface range fastethernet 0/1 - 2 sw(config-if)# switchport mode private-vlan host sw2(config-if)# switchport private-vlan host-association 100 202 <---- i already did the association of 202 to 100, why do this again? sw(config-if)# interface range fastethernet 0/3 - 4 sw(config-if)# switchport mode private-vlan host sw2(config-if)# switchport private-vlan host-association 100 201 <---- same here
Is it just a command syntax or there is some in-depth logic about this? Maybe someone could post a complex example of pvlan configuration where those commands make sense?
Thanks!
... View more
Labels:
11-13-2016
11:31 PM
I had a lot of additional work to do to make upgrade from 3.5 to 3.6, cause it does not support issu.
But now it's done and I can confirm that in 3.6.5E all is working good. :)
... View more
10-31-2016
01:16 AM
Thanks for sharing. So it seems like IOS version issue, cause I have trunks with ALL vlans allowed.
... View more
10-31-2016
12:06 AM
I use v2. I think that v3 will work the same, but I'll check asap.
... View more
10-30-2016
11:50 AM
The answer was as simple as weird. One can poll for all interfaces with snmp requests in context '0'. For example,
.1.3.6.1.2.1.17.1.4.1.2.1 [INTEGER]: 2 .1.3.6.1.2.1.17.1.4.1.2.2 [INTEGER]: 3 .1.3.6.1.2.1.17.1.4.1.2.3 [INTEGER]: 4 .1.3.6.1.2.1.17.1.4.1.2.4 [INTEGER]: 5 .1.3.6.1.2.1.17.1.4.1.2.5 [INTEGER]: 6 .1.3.6.1.2.1.17.1.4.1.2.6 [INTEGER]: 7 .1.3.6.1.2.1.17.1.4.1.2.7 [INTEGER]: 8 .1.3.6.1.2.1.17.1.4.1.2.8 [INTEGER]: 9 .1.3.6.1.2.1.17.1.4.1.2.9 [INTEGER]: 10 .1.3.6.1.2.1.17.1.4.1.2.10 [INTEGER]: 11 .1.3.6.1.2.1.17.1.4.1.2.11 [INTEGER]: 12 .1.3.6.1.2.1.17.1.4.1.2.12 [INTEGER]: 13 .1.3.6.1.2.1.17.1.4.1.2.13 [INTEGER]: 14 .1.3.6.1.2.1.17.1.4.1.2.14 [INTEGER]: 15 .1.3.6.1.2.1.17.1.4.1.2.15 [INTEGER]: 16 .1.3.6.1.2.1.17.1.4.1.2.16 [INTEGER]: 17 .1.3.6.1.2.1.17.1.4.1.2.1281 [INTEGER]: 18 .1.3.6.1.2.1.17.1.4.1.2.1282 [INTEGER]: 19 .1.3.6.1.2.1.17.1.4.1.2.1283 [INTEGER]: 20 .1.3.6.1.2.1.17.1.4.1.2.1284 [INTEGER]: 21 .1.3.6.1.2.1.17.1.4.1.2.1285 [INTEGER]: 22 .1.3.6.1.2.1.17.1.4.1.2.1286 [INTEGER]: 23 .1.3.6.1.2.1.17.1.4.1.2.1287 [INTEGER]: 24 .1.3.6.1.2.1.17.1.4.1.2.1288 [INTEGER]: 25 .1.3.6.1.2.1.17.1.4.1.2.1289 [INTEGER]: 26 .1.3.6.1.2.1.17.1.4.1.2.1290 [INTEGER]: 27 .1.3.6.1.2.1.17.1.4.1.2.1291 [INTEGER]: 28 .1.3.6.1.2.1.17.1.4.1.2.1292 [INTEGER]: 29 .1.3.6.1.2.1.17.1.4.1.2.1293 [INTEGER]: 30 .1.3.6.1.2.1.17.1.4.1.2.1294 [INTEGER]: 31 .1.3.6.1.2.1.17.1.4.1.2.1295 [INTEGER]: 32 .1.3.6.1.2.1.17.1.4.1.2.1296 [INTEGER]: 33 .1.3.6.1.2.1.17.1.4.1.2.2561 [INTEGER]: 41 .1.3.6.1.2.1.17.1.4.1.2.2562 [INTEGER]: 42 .1.3.6.1.2.1.17.1.4.1.2.2563 [INTEGER]: 43 .1.3.6.1.2.1.17.1.4.1.2.2569 [INTEGER]: 44 .1.3.6.1.2.1.17.1.4.1.2.2570 [INTEGER]: 45 .1.3.6.1.2.1.17.1.4.1.2.2575 [INTEGER]: 321 .1.3.6.1.2.1.17.1.4.1.2.2623 [INTEGER]: 46 .1.3.6.1.2.1.17.1.4.1.2.2624 [INTEGER]: 47 .1.3.6.1.2.1.17.1.4.1.2.2651 [INTEGER]: 337 .1.3.6.1.2.1.17.1.4.1.2.2652 [INTEGER]: 338
Why there was a need to do like that? I have a bunch of other cisco switch models and none of them does not even respond to '0' context.
... View more
10-30-2016
04:08 AM
gpauwen,
this option does not affect anything. All numbers are the same.
... View more
Created by
Alexander Proskurnin
in Switching
in Switching
10-29-2016
04:17 AM
10-29-2016
04:17 AM
Hi all!
We have 2 WS-C4500X-16 SFP+ bundled as VSS running cat4500e-universalk9.SPA.03.05.03.E.152-1.E3.
Try to poll lldp topology from it and can't figure out how to map lldp port id to the ifindex of the interface. For example:
ifIndex list:
.1.3.6.1.2.1.2.2.1.1.1 [INTEGER] = 1 .1.3.6.1.2.1.2.2.1.1.344 [INTEGER] = 344
LLDP Neighbors (lldpRemChassisId):
.1.0.8802.1.1.2.1.4.1.1.5.0.11.2 [Hex-STRING] = A8 F9 4B 95 C7 00 .1.0.8802.1.1.2.1.4.1.1.5.0.12.4 [Hex-STRING] = A8 F9 4B E8 05 C0 .1.0.8802.1.1.2.1.4.1.1.5.0.1291.1 [Hex-STRING] = A8 F9 4B 95 C7 00 .1.0.8802.1.1.2.1.4.1.1.5.0.1292.3 [Hex-STRING] = A8 F9 4B E8 05 C0
Local port naming (lldpLocPortId):
.1.0.8802.1.1.2.1.3.7.1.3.11 [STRING] = Te1/1/11 .1.0.8802.1.1.2.1.3.7.1.3.12 [STRING] = Te1/1/12 .1.0.8802.1.1.2.1.3.7.1.3.1291 [STRING] = Te2/1/11 .1.0.8802.1.1.2.1.3.7.1.3.1292 [STRING] = Te2/1/12
So we have lldp ports 11,12,1291,1292. LLDP MIB says:
A port number has no mandatory relationship to an InterfaceIndex object (of the interfaces MIB, IETF RFC 2863). If the LLDP agent is a IEEE 802.1D, IEEE 802.1Q bridge, the LldpPortNumber will have the same value as the dot1dBasePort object (defined in IETF RFC 1493) associated corresponding bridge port. If the system hosting LLDP agent is not an IEEE 802.1D or an IEEE 802.1Q bridge, the LldpPortNumber will have the same value as the corresponding interface's InterfaceIndex object.
And here is a dot1dBasePort and dot1dBasePortIfIndex poll:
.1.3.6.1.2.1.17.1.4.1.1.2561 [INTEGER] = 2561 .1.3.6.1.2.1.17.1.4.1.1.2562 [INTEGER] = 2562 .1.3.6.1.2.1.17.1.4.1.1.2563 [INTEGER] = 2563 .1.3.6.1.2.1.17.1.4.1.1.2570 [INTEGER] = 2570 .1.3.6.1.2.1.17.1.4.1.1.2623 [INTEGER] = 2623 .1.3.6.1.2.1.17.1.4.1.1.2624 [INTEGER] = 2624 .1.3.6.1.2.1.17.1.4.1.1.2651 [INTEGER] = 2651 .1.3.6.1.2.1.17.1.4.1.1.2652 [INTEGER] = 2652
.1.3.6.1.2.1.17.1.4.1.2.2561 [INTEGER] = 41 .1.3.6.1.2.1.17.1.4.1.2.2562 [INTEGER] = 42 .1.3.6.1.2.1.17.1.4.1.2.2563 [INTEGER] = 43 .1.3.6.1.2.1.17.1.4.1.2.2570 [INTEGER] = 45 .1.3.6.1.2.1.17.1.4.1.2.2623 [INTEGER] = 46 .1.3.6.1.2.1.17.1.4.1.2.2624 [INTEGER] = 47 .1.3.6.1.2.1.17.1.4.1.2.2651 [INTEGER] = 337 .1.3.6.1.2.1.17.1.4.1.2.2652 [INTEGER] = 338
Not only the output does not map lldp port to bridge port, but the bridge ports does not contain ALL ports. 41-47, 337,338 are ifIndexes of Portchannels and not individual physical ports. Does any one know something about this issue, maybe newer software?
... View more
Labels:
06-16-2015
03:18 AM
I read an interesting paragraph in the article about how to configure wccp (http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp/configuration/12-4t/iap-12-4t-book/iap-wccp.html). WCCPv2 Web Cache Packet Return If a content engine is unable to provide a requested object it has cached due to error or overload, the content engine will return the request to the router for onward transmission to the originally specified destination server. WCCPv2 provides a check on packets that determines which requests have been returned from the content engine unserviced. Using this information, the router can then forward the request to the originally targeted server (rather than attempting to resend the request to the content engine cluster). This process provides error handling transparency to clients. Typical reasons why a content engine would reject packets and initiate the packet return feature include the following Instances when the content engine is overloaded and has no room to service the packets Instances when the content engine is filtering for certain conditions that make caching packets counterproductive (for example, when IP authentication has been turned on) And I can't find any more details about how this stuff works. How it's determined that request is unserviced? What flags and where in the packet does this indicate? Does this mean that wccp router caches such unserviced requests and all further requests will go directly to target server or it happens on per-packet basis? Thanks in advance!
... View more
Labels:
07-31-2013
12:21 AM
Hello everybody! I'm trying to configure ntp server on ASR1002f ( asr1000rp1-advipservicesk9.03.09.01.S.153-2.S1.bin) , but i get a lot of annoying log messages like this: Jul 30 20:14:56.180 MSK: %NTP : Drift Value NTPv4_Drift=0.E68F not saved in persistent data, will be stored before reload Jul 30 21:14:56.179 MSK: %NTP : Drift Value NTPv4_Drift=0.EB94 not saved in persistent data, will be stored before reload Jul 30 22:14:56.179 MSK: %NTP : Drift Value NTPv4_Drift=0.EBA9 not saved in persistent data, will be stored before reload Jul 30 23:14:56.179 MSK: %NTP : Drift Value NTPv4_Drift=0.F3EF not saved in persistent data, will be stored before reload Jul 31 00:14:56.179 MSK: %NTP : Drift Value NTPv4_Drift=0.F53E not saved in persistent data, will be stored before reload Jul 31 01:14:56.179 MSK: %NTP : Drift Value NTPv4_Drift=0.F5C4 not saved in persistent data, will be stored before reload Jul 31 02:14:56.180 MSK: %NTP : Drift Value NTPv4_Drift=0.FAC5 not saved in persistent data, will be stored before reload Jul 31 03:14:56.180 MSK: %NTP : Drift Value NTPv4_Drift=0.FAD9 not saved in persistent data, will be stored before reload Jul 31 04:14:56.180 MSK: %NTP : Drift Value NTPv4_Drift=0.FAE5 not saved in persistent data, will be stored before reload Jul 31 05:14:56.179 MSK: %NTP : Drift Value NTPv4_Drift=0.FAF1 not saved in persistent data, will be stored before reload Could someone clarify what does this mean and how to stop this? If I turn on ntp logging I get periodic ntp messages like so: .Jul 26 15:52:40.790 MSK: NTP Core (INFO): 0.0.0.0 C618 08 no_sys_peer .Jul 26 15:52:40.790 MSK: NTP Core (INFO): 0.0.0.0 C61C 0C clock_step .Jul 26 15:52:41.789 MSK: NTP Core (INFO): 192.168.10.225 962A 8A sys_peer .Jul 26 15:52:41.789 MSK: NTP Core (NOTICE): Clock is synchronized. Jul 26 15:52:42.201 MSK: NTP Core (INFO): 0.0.0.0 C62C 0C clock_step Jul 26 15:52:42.201 MSK: NTP Core (NOTICE): Clock synchronization lost. .Jul 26 15:53:37.792 MSK: NTP Core (INFO): IP1 962A 8A sys_peer .Jul 26 15:53:37.792 MSK: NTP Core (NOTICE): Clock is synchronized. Jul 26 16:04:51.791 MSK: NTP Core (NOTICE): Clock synchronization lost. .Jul 26 16:04:51.791 MSK: NTP Core (INFO): IP2 962A 8A sys_peer .Jul 26 16:04:51.791 MSK: NTP Core (NOTICE): Clock is synchronized. Jul 26 16:07:05.791 MSK: NTP Core (NOTICE): Clock synchronization lost. .Jul 26 16:07:05.791 MSK: NTP Core (INFO): IP3 962A 8A sys_peer .Jul 26 16:07:05.791 MSK: NTP Core (NOTICE): Clock is synchronized. Jul 27 12:29:47.789 MSK: NTP Core (NOTICE): Clock synchronization lost. .Jul 27 12:29:47.789 MSK: NTP Core (INFO): IP2 961A 8A sys_peer .Jul 27 12:29:47.789 MSK: NTP Core (NOTICE): Clock is synchronized. Jul 27 14:38:23.792 MSK: NTP Core (NOTICE): Clock synchronization lost. .Jul 27 14:38:23.792 MSK: NTP Core (INFO): IP1 961A 8A sys_peer .Jul 27 14:38:23.792 MSK: NTP Core (NOTICE): Clock is synchronized. Jul 27 15:41:33.790 MSK: NTP Core (NOTICE): Clock synchronization lost. .Jul 27 15:41:33.790 MSK: NTP Core (INFO): IP3 961A 8A sys_peer .Jul 27 15:41:33.790 MSK: NTP Core (NOTICE): Clock is synchronized.
... View more
Labels:
Created by
Alexander Proskurnin
in Wireless Security and Network Management
03-28-2019
03-28-2019
We don't know what can be done with ISE 'cause we don't have it :) but
our 3rd party portal do cache...
Created by
Alexander Proskurnin
in Wireless Security and Network Management
03-28-2019
03-28-2019
>>> Interested to know the use case of why u need it different on a per
user/user group. I use open ...
Created by
Alexander Proskurnin
in Wireless Security and Network Management
03-28-2019
03-28-2019
Hi, Haydn! ver 8.3.102.0This command is available, but I need to
override it by AVP from radius.(Cis...
Created by
Alexander Proskurnin
in Wireless Security and Network Management
03-27-2019
03-27-2019
Here the output from WLC. And it correctly recognizes
AVPs:*radiusTransportThread: Mar 27 15:09:02.2...
Created by
Alexander Proskurnin
in Wireless Security and Network Management
03-27-2019
03-27-2019
Hi all!I can't find any info about which AAA attributes are supported by
WLC2504 (ver 8.3.102.0). Es...
11-18-2016
Sorry for my explanation. I mean why do we have command switchport
private-vlan host-association 100...
11-18-2016
I wonder why when configuring pvlan feature we need to map secondary
vlan to primary vlan 2 times. s...
11-13-2016
I had a lot of additional work to do to make upgrade from 3.5 to 3.6,
cause it does not support issu...
10-31-2016
Thanks for sharing. So it seems like IOS version issue, cause I have
trunks with ALL vlans allowed.
10-30-2016
The answer was as simple as weird. One can poll for all interfaces with
snmp requests in context '0'...
Created by
Alexander Proskurnin
in Switching
10-29-2016
10-29-2016
Hi all! We have 2 WS-C4500X-16 SFP+ bundled as VSS running
cat4500e-universalk9.SPA.03.05.03.E.152-1...
06-16-2015
I read an interesting paragraph in the article about how to configure
wccp
(http://www.cisco.com/c/e...
Public Statistics
| Date Registered | 08-27-2010 04:17 AM |
| Date Last Visited | 04-04-2019 06:42 AM |
| Total Messages Posted | 36 |
.jpg "Hall of Fame Master"){kind=icon}
