Hi, I have not seent his error before. It is unusual to me. switch:          unable to enter in this mode to do the same steps  once agains Can you send a screen shot of the full boot process as you did before. ========================== http://www.rconfig.com   A free, open source network device configuration management tool, customizable to your needs! - Always vote on an answer if you found it helpful ... View more

HI, The issue is ACLs are not stateful on their own. You either need to use Reflexive Access Lists or a firewall like Cisco IOS CBAC or ZBF. http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scfreflx.html http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a0080094e8b.shtml http://packetlife.net/blog/2012/jan/30/ios-zone-based-firewall/ ========================== http://www.rconfig.com   A free, open source network device configuration management tool, customizable to your needs! - Always vote on an answer if you found it helpful ... View more

Well, back to basics i guess. Is there an ARP entry on the ACE for Server1-10.1.3.11? What is it? Can the ACE ping the server? ========================== http://www.rconfig.com   A free, open source network device configuration management tool, customizable to your needs! - Always vote on an answer if you found it helpful ... View more

When you set the servers default Gateway is set as 10.1.3.1, can you run a continous ping to a host in the 10.1.2.x subnet. Run a 'show access-list INBOUND' and make sure the counter is incrementing. Then also do a 'sh conn' and ensure you see connections for this pair in the connection table. Also, enabel logging and ensure no errors in the logs. logging enable logging timestamp logging buffered 6 Also, I assume you have routing configured correctly in the 10.1.2.x subnet to route back to 10.1.3.x via 10.21.2.4? ========================== http://www.rConfig.com   A free, open source network device configuration management tool, customizable to your needs! - Always vote on an answer if you found it helpful ... View more

First tip is to remove the teamviewer ID and password from your output. Next, i dont see where you ran the 'copy xmodem' command. You need to run this command from the CLI and then send xmodem from hyperterm. Specific instructions are here. Issue the copy xmodem:                 flash:c3560-ipbase-mz.122-25.SEB4.bin command on the                 switch. Here is an example: switch: copy xmodem: flash:c2955-i6q4l2-mz.121-13.EA1.bin Begin the Xmodem or Xmodem-1K transfer now... CCC From the top of the HyperTerminal window, choose Transfer                 > Send File. Choose the Xmodem protocol in the Send File                 dialog box and click Browse in order to select the Cisco IOS                 image (.bin file) that you downloaded previously. Click Send in order to begin the Xmodem                 transfer. The Xmodem file transfer begins. This transfer can take up to 2                 hours, which depends on the size of the image. CCCCCCC......................................................................... ................................................................................ ................................................................................ ................................................................................ ................................................................................ ................................................................................ ................................................................................ ................................................................................ ............................................................................. File "xmodem:" successfully copied to "flash:c2955-i6q4l2-mz.121-13.EA1.bin" !--- If the Xmodem file transfer fails for some reason, restart the process. !--- If the Xmodem file transfer is successful, you return to the !--- switch: prompt. switch: Boot the new image that you just copied over with the Xmodem             procedure. Issue the boot             flash:filename command, as this example             shows: switch: boot flash:c2955-i6q4l2-mz.121-13.EA1.bin Loading "flash:c2955-i6q4l2-mz.121-13.EA1.bin"...############################### ################################################################################ !--- Output suppressed. Press RETURN to get started! Switch> !--- The bootup was successful. Be sure to verify that your boot statements are set             correctly. ========================== http://www.rConfig.com   A free, open source network device configuration management tool, customizable to your needs! - Always vote on an answer if you found it helpful ... View more

Hi See full document here on how to restore an image. Read in fully before doing any configuration. http://www.cisco.com/en/US/products/hw/switches/ps628/products_tech_note09186a0080169696.shtml Youa re using an incorrect copy command. It is supposed to look like this. copy xmodem: flash:c2955-i6q4l2-mz.121-13.EA1.bin ========================== http://www.rConfig.com   A free, open source network device configuration management tool, customizable to your needs! - Always vote on an answer if you found it helpful ... View more

Thats not really that high And is most likley traffic related. You can read over this useful document which explains the IP Input process in detail and how to determine why is is rising higher than other process. http://www.cisco.com/en/US/products/hw/routers/ps359/products_tech_note09186a00801c2af3.shtml Be careful with running some of the debugs on your switch. ========================== http://www.rConfig.com   A free, open source network device configuration management tool, customizable to your needs! - Always vote on an answer if you found it helpful ... View more

This looks wrong to me... access-list 101 permit tcp any eq 3389 host 10.x.x.x eq 3389 log Should be access-list 101 permit tcp any host 10.x.x.x eq 3389 log In the first ACE you are saying, allow if the source port is 3389 and the destination port is 3389. RDP connections will be generated client side form the ephemeral port range, therefore the client side, or source prot could be anything http://en.wikipedia.org/wiki/Ephemeral_port ========================== http://www.rConfig.com   A free, open source network device configuration management tool, customizable to your needs! - Always vote on an answer if you found it helpful ... View more

See the full restore document here http://www.cisco.com/en/US/products/hw/switches/ps628/products_tech_note09186a0080169696.shtml You will need to have local access to the switch. ========================== http://www.rConfig.com   A free, open source network device configuration management tool, customizable to your needs! - Always vote on an answer if you found it helpful ... View more

Your design is good. But as for the subnet between the core (router or L3 switch - switch preffered) and edge FW, i suggest something a little larger than a /30. Like a /28. You may want to add a standby FW in a few months or years, or a new WAN connection to that 'demarc' subnet' at some point. It's good practice to leave some romo for growth. Even if you dont forsee it right now. ========================== http://www.rConfig.com   A free, open source network device configuration management tool, customizable to your needs! - Always vote on an answer if you found it helpful ... View more