About John Blakley

John Blakley · ‎10-20-2015

I have no experience with Azure, so I'm not sure what the vpn is for. I'm assuming that you're doing this to MS? Anyway, you can configure vpns on 8.25, so you may want to find out why they want a version => 8.3. The 8.3 upgrade will tremendously increase your config. It reconfigures your nat rules. Now, you have static nats that look like: static (inside,outside) 1.1.1.1 192.168.1.1 netmask 255.255.255.255 After 8.3, you'll have an object for every address that you have on top of a nat rule: object obj_1.1.1.1 host 1.1.1.1 object obj_192.168.1.1 host 192.168.1.1 nat (inside,outside) static 1.1.1.1 The above is a quick example. The conversion utility will make many changes to your nat static and dynamic rules. This is a major upgrade, and Cisco even recommended to me to have a 3-hour outage window for troubleshooting purposes. Another note, as you can see above it's going to tremendously increase the amount of lines that you have in your config. You may also be surprised to find out that (well, in my case at least) there was a lot of redundancy in the converted config. I swear I had 50 "obj_192.168.1.0" objects. They were configured like: obj_192.168.1.0 obj_192.168.1.0_1 obj_192.168.1.0_2 etc. For whatever reason, the converter didn't take the one object and apply it to several rules, but instead created an object for each rule. The other side of this is that you're on an old version of IOS, so upgrading would be a good thing for that alone. You will want to make sure that your hardware can run the new version as there are some requirements (like some models require 2Gb of ram). I wouldn't let a vendor tell me I must be on a new version unless they can give me a good reason why. As far as I know, vpn didn't change between versions so that wouldn't keep you from being able to get a tunnel up with them. HTH, John

John Blakley · ‎10-16-2015

The Dell switches will use "show bridge address" and you can find them that way...

John Blakley · ‎10-15-2015

Finbarr, " when I changed back to my original confit for acl199 it worked again." This is because your original acl was "permit ip any any." When you changed to "permit ip 192.168.1.0 0.0.0.255 any", it would have stopped working because your ACL 199 is applied outbound on the wan interface. NAT happens before ACLs are checked, so you would have seen your traffic come out as whatever the wan address is and you weren't allowing that by changing from "any any". You need to get to a basic config: 1. Rip all acls off of the interfaces just to get this to work. 2. Change your acl 199 to "permit ip 192.168.1.0 0.0.0.255 any" 3. Test - it should work You always try to get it to work without additional config. Once it's working, start putting things in one at a time so you can troubleshoot each if it breaks. You know that "A" works, but when you put "B" in, "A" stops working...no need to troubleshoot A if you know B broke it. Make sense? HTH, John

John Blakley · ‎10-15-2015

Finbarr, On you dialer interface, the acl 100 is blocking all traffic and that includes your return traffic. For testing, remove this acl and see if you can get out. Once you verify that, we can move forward with creating an acl that works for you. You should also change acl 199 to tie to your specific internal addresses instead of "any any". Change this to be: access-list 199 permit ip 192.168.1.0 0.0.0.255 any HTH, John

John Blakley · ‎10-14-2015

John, I'm not sure I understand what your question is. If your hosts are using 192.168.1.100 as their default gateway (regardless of what switch they're on), they can pull from a local pull on the switch as long as you have a scope in the 192.168.0.0/22. If you don't have one on here, you can redirect your requests to another server using a helper address on vlan 3's svi. As far as the dns-server line, you can use anything you want here as long as the host can get to it either internal or natted to the internet. HTH, John

John Blakley · ‎10-14-2015

Finbarr, This is a fairly common issue, so if you can post your config I'm sure someone will be able to get you up and running. If you believe it's an acl issue, you may want to remove the acl first to see if that resolves the issue. If not, then it's something else and we'll probably need the config... HTH, John

John Blakley · ‎10-14-2015

You should be able to use rspan. Take a look at this link: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html HTH, John

John Blakley · ‎10-14-2015

Can you post your config if the following doesn't help? Try this: access-list 100 permit ip 10.0.0.0 0.0.0.255 any ip nat inside source list 100 interface <wan interface> overload int <wan interface> ip nat out int <vlan interface> ip nat in The only issue that I have right now is that you said a device will handle natting. Is that in front of the router or behind? If it's in front of the router, you should assign all private addressing to the router's wan and lan side and not nat on the router. You would need a static route on your other device pointing to the wan interface of this router to get back to your 10.0.0.0/24 subnet. HTH, John

John Blakley · ‎10-06-2015

Thanks Joseph! So, does this mean that if the medium class will have the ability to scale the low class back if another medium flow begins? ** Edit ** Also, do you know if there's a way to see how much bandwidth a flow is taking? I don't know of a command, and netflow only shows you a total amount of data transferred... Thanks!

John Blakley · ‎10-06-2015

All, I had a couple more questions about qos brought up to me: Example: policy-map Test class Voice priority percent 20 class Medium bandwidth remaining percent 60 class Low bandwidth remaining percent 30 class class-default bandwidth remaining percent 10 Let's say the minimums for ease of math is Voice - 5Mb, Medium - 3Mb, Low - 2Mb, Default 1Mb on a 10Mb circuit (I know the math doesn't work...it's just for example) The policy above is close to what we use in our environment. The question that was brought up was: 1. If the Medium class has hit the guaranteed bandwidth, and it doesn't need any more than the minimum, the low class can share the bandwidth remaining. If the medium class only needs 3Mb, but the Low class needs 7Mb (to equate to the 10Mb), it would be allowed to do so? 2. If so, since there's no cap on either queue, when another flow that needs to match on the Medium class comes in, will it be able to get any bandwidth since it's met the minimum guarantee already. I'm thinking that it won't and the Low queue flow can actually saturate the circuit. 3. Just for clarification, the router will allow the lower classes to use the llq reservation if the llq is not being used, correct? Thanks! John

John Blakley · ‎10-03-2015

if they only have a single path out, it makes no difference if they have a single static default route vs a bgp learned default route. The bgp process in itself takes up memory to run on the router, so having just a static route advertised may be overkill to run bgp for. If they have multipaths out, it may make sense depending on what your customer is needing to do.... HTH, John

John Blakley · ‎10-02-2015

Can you post your config?

John Blakley · ‎10-02-2015

Michael, CDP will go through switches. For example, if I have a Cisco --- Dell ---- Cisco, the Cisco will see the other Cisco, but it won't see the Dell. It's L2, so there's nothing to block the traffic between switches. CDP-supported equipment can read the packet and get the information out of it, whereas non-CDP equipment will happily pass it along.... HTH, John

John Blakley · ‎10-02-2015

I would say allow protocol 88 (eigrp) through the firewall between the two addresses. You may also try to set up unicast peering (with neighbor command) between the two routers so multicast packet doesn't get blocked... HTH, John

John Blakley · ‎10-02-2015

You can look for a port with more than one mac address and make the assumption that those ports have ip addresses attached... HTH, John

Date Registered	‎05-27-2005 10:49 AM
Date Last Visited	‎08-18-2017 06:46 PM
Total Messages Posted	5,470
Total Helpful Votes Received	3223

I have no experience with

The Dell switches will use

Finbarr,"when I changed back

Finbarr,On you dialer

John,I'm not sure I

Finbarr,This is a fairly

You should be able to use

Can you post your config if

Thanks Joseph! So, does this

Bandwidth guarantees and usage

if they only have a single

Can you post your config?

Michael,CDP will go through

I would say allow protocol 88

You can look for a port with