Hi All,         I have Cisco 1800 router configured with remote access vpn. My internal LAN are 192.168.1.X and 192.168.2.X. Client pool is configured to be 192.168.100.X, I can connect to vpn and get the IP as per client pool, but can not access the internal LAN except when I have an IP addres of range 192.168.1.X or 2.X in my remote laptop.   Remote PC IP 192.168.1.X or 2.X- VPN client IP 192.168.100.X---> Internal LAN accessible Remote PC IP other than 192.168.1.X or 2.X - VPN client IP 192.168.100.X---> Internal LAN inaccessible   Please find below vpn config for your reference.   aaa new-model ! aaa authentication login VPN_CLIENT_LOGIN local aaa authorization network VPN_CLIENT_GROUP local ! username admin secret 5 "PASSWORD" ! crypto isakmp policy 10  encr 3des  authentication pre-share  group 2  lifetime 3600 ! crypto isakmp client configuration group VPN_CLIENTS  key "KEY"  dns X.X.X.X  domain KK.local  pool VPN_CLIENT-POOL  acl 110  max-users 10  max-logins 10 ! crypto ipsec transform-set TRANS_3DES_SHA esp-3des esp-sha-hmac  mode tunnel no crypto ipsec nat-transparency udp-encapsulation ! crypto dynamic-map EXT_DYNAMIC_MAP 10  set transform-set TRANS_3DES_SHA  reverse-route ! crypto map EXT_MAP local-address Vlan1 crypto map EXT_MAP client authentication list VPN_CLIENT_LOGIN crypto map EXT_MAP isakmp authorization list VPN_CLIENT_GROUP crypto map EXT_MAP client configuration address respond crypto map EXT_MAP 10 ipsec-isakmp dynamic EXT_DYNAMIC_MAP ! interface Vlan1  description *** LAN ***  ip address 192.168.2.1 255.255.255.0 secondary  ip address Y.Y.Y.Y 255.255.255.252  ip nat inside  ip virtual-reassembly in ! ip local pool VPN_CLIENT-POOL 192.168.100.0 192.168.100.255 ! ip nat inside source list NAT interface Vlan1 overload ! ip route 0.0.0.0 0.0.0.0 "ISP NEXT HOP" ip route 192.168.1.0 255.255.255.0 192.168.2.2 ! ip access-list extended NAT  deny   ip 192.168.1.0 0.0.0.255 192.168.100.0 0.0.0.255  deny   ip 192.168.2.0 0.0.0.255 192.168.100.0 0.0.0.255  permit ip any any ! access-list 110 permit ip 192.168.100.0 0.0.0.255 host 0.0.0.0 Look forward for any help.   Thanks & Regards Ahmed... ... View more

Dear All,              We have Exterity IPTV solution implemented in our network. We have cisco 4507R with 3560 edge switches. Now we are facing lot of multicast/broadcast flooding in our network due to which our voice and data vlans are affected. I need suggestion to stop multicast/broadcast flooding. (please check attached wireshark screenshot)   On core switch the config looks like   interface Vlan30 description *** IPTV *** ip address 101.101.2.X 255.255.0.0 ip pim sparse-dense-mode ip igmp query-interval 60   ++++++++++++++++++++++++++++++ sh ip igmp groups IGMP Connected Group Membership Group Address Interface Uptime Expires Last Reporter Group Accounted 239.192.1.77 Vlan30 33w6d 00:01:06 101.101.2.121 239.1.1.1 Vlan30 1w1d 00:00:59 101.101.2.53 239.192.137.79 Vlan30 33w6d 00:01:11 101.101.2.79 239.255.255.255 Vlan30 33w6d 00:01:06 101.101.2.232 239.192.136.78 Vlan30 5w6d 00:01:08 101.101.2.218 239.192.3.6 Vlan30 33w6d 00:01:12 101.101.2.113 239.192.3.7 Vlan30 9w6d 00:01:09 101.101.2.7 239.192.3.77 Vlan30 33w6d 00:01:13 101.101.2.77 239.192.2.8 Vlan30 2w5d 00:01:14 101.101.2.8 239.192.2.9 Vlan30 27w5d 00:01:07 101.101.2.62 . . . +++++++++++++++++++++++++++++++++++++++++++ sh ip igmp snooping vlan 30 detail Global IGMP Snooping configuration: ------------------------------------------- IGMP snooping : Enabled IGMPv3 snooping : Enabled Report suppression : Enabled TCN solicit query : Disabled TCN flood query count : 2 Last Member Query Interval : 1000 Vlan 30: -------- IGMP snooping : Enabled CAPWAP enabled : Disabled IGMPv2 immediate leave : Disabled Explicit host tracking : Enabled Multicast router learning mode : pim-dvmrp CGMP interoperability mode : IGMP_ONLY Last Member Query Interval : 1000 Topology change : No ++++++++++++++++++++++++++++++ sh ip igmp interface vlan 30 Vlan30 is up, line protocol is up Internet address is 101.101.2.X/16 IGMP is enabled on interface Current IGMP host version is 2 Current IGMP router version is 2 IGMP query interval is 25 seconds IGMP configured query interval is 60 seconds IGMP querier timeout is 50 seconds IGMP configured querier timeout is 120 seconds IGMP max query response time is 10 seconds Last member query count is 2 Last member query response interval is 1000 ms Inbound IGMP access group is not set IGMP activity: 2459 joins, 2406 leaves Multicast routing is enabled on interface Multicast TTL threshold is 0 Multicast designated router (DR) is 101.101.2.X (this system) IGMP querying router is 101.101.2.X (this system) Multicast groups joined by this system (number of users): 224.0.1.40(1) +++++++++++++++++++++++++++++++ sh ip igmp snooping querier detail Vlan IP Address IGMP Version Port ------------------------------------------------------------- 30 101.101.2.X v2 Router Global IGMP switch querier status -------------------------------------------------------- admin state : Disabled admin version : 2 source IP address : 0.0.0.0 query-interval (sec) : 60 max-response-time (sec) : 10 querier-timeout (sec) : 120 tcn query count : 2 tcn query interval (sec) : 10 ++++++++++++++++++++++++++++++++++++++   On edge switches   sh ip igmp snooping Global IGMP Snooping configuration: ------------------------------------------- IGMP snooping : Enabled IGMPv3 snooping (minimal) : Enabled Report suppression : Enabled TCN solicit query : Disabled TCN flood query count : 2 Robustness variable : 2 Last member query count : 2 Last member query interval : 1000 ++++++++++++++++++++++++++++++++++++++ sh ip igmp snooping vlan 30 detail Global IGMP Snooping configuration: ------------------------------------------- IGMP snooping : Enabled IGMPv3 snooping (minimal) : Enabled Report suppression : Enabled TCN solicit query : Disabled TCN flood query count : 2 Robustness variable : 2 Last member query count : 2 Last member query interval : 1000 Vlan 30: -------- IGMP snooping : Enabled IGMPv2 immediate leave : Disabled Multicast router learning mode : pim-dvmrp CGMP interoperability mode : IGMP_ONLY Robustness variable : 2 Last member query count : 2 Last member query interval : 1000 Topology change : No +++++++++++++++++++++++++++++++++++++   Look forward for positive response.   Thanks & Regards Ahmed... ... View more

Dear All,             One of our customers wants to enable 2 factor authentication for SSH access to their network devices. Currently they have Cisco ISE (ACS-licensed) for device administration(TACACS+). Cisco ISE is integrated with LDAP. Customer wants to integrate RSA secureID with Cisco ISE, so that whenever user wants to access SSH session to network devices, RSA will send token to the user and once he/she gets authenticated, he/she will be prompted for ssh username/password for network devices.   Look forward for positive response.   Thanks & Regards Ahmed... ... View more

We have L2L VPN between 2 sites working without any issue, except we are not able to access ssh/asdm of remote ASA (DR) from local LAN of local ASA (HQ). We have followed this cisco document  https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/118092-configure-asa-00.html#anc7 we have 1. route-lookup for No-NAT subnets (local and remote ASA) 2. management-access inside ( remote ASA) 3. SSH/HTTP allowed on inside interface (remote ASA) 4. SSH/HTTP allowed on outside interface (remote ASA) 5. Routing is okay 6. We can see packet leaves local ASA and hits remote ASA (ASDM monitoring).   Your input is highly appreciated and look forward for positive response. Thanks & Regards Ahmed...       ... View more