Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About John Blakley
Stats
Member since
05-27-2005
5470
Posts
3473
Helpful
610
Solutions
10-20-2015
04:07 AM
I have no experience with Azure, so I'm not sure what the vpn is for. I'm assuming that you're doing this to MS? Anyway, you can configure vpns on 8.25, so you may want to find out why they want a version => 8.3. The 8.3 upgrade will tremendously increase your config. It reconfigures your nat rules. Now, you have static nats that look like: static (inside,outside) 1.1.1.1 192.168.1.1 netmask 255.255.255.255 After 8.3, you'll have an object for every address that you have on top of a nat rule: object obj_1.1.1.1 host 1.1.1.1 object obj_192.168.1.1 host 192.168.1.1 nat (inside,outside) static 1.1.1.1 The above is a quick example. The conversion utility will make many changes to your nat static and dynamic rules. This is a major upgrade, and Cisco even recommended to me to have a 3-hour outage window for troubleshooting purposes. Another note, as you can see above it's going to tremendously increase the amount of lines that you have in your config. You may also be surprised to find out that (well, in my case at least) there was a lot of redundancy in the converted config. I swear I had 50 "obj_192.168.1.0" objects. They were configured like: obj_192.168.1.0 obj_192.168.1.0_1 obj_192.168.1.0_2 etc. For whatever reason, the converter didn't take the one object and apply it to several rules, but instead created an object for each rule. The other side of this is that you're on an old version of IOS, so upgrading would be a good thing for that alone. You will want to make sure that your hardware can run the new version as there are some requirements (like some models require 2Gb of ram). I wouldn't let a vendor tell me I must be on a new version unless they can give me a good reason why. As far as I know, vpn didn't change between versions so that wouldn't keep you from being able to get a tunnel up with them. HTH, John
... View more
10-16-2015
05:12 AM
The Dell switches will use "show bridge address" and you can find them that way...
... View more
10-15-2015
09:24 AM
Finbarr, " when I changed back to my original confit for acl199 it worked again." This is because your original acl was "permit ip any any." When you changed to "permit ip 192.168.1.0 0.0.0.255 any", it would have stopped working because your ACL 199 is applied outbound on the wan interface. NAT happens before ACLs are checked, so you would have seen your traffic come out as whatever the wan address is and you weren't allowing that by changing from "any any". You need to get to a basic config: 1. Rip all acls off of the interfaces just to get this to work. 2. Change your acl 199 to "permit ip 192.168.1.0 0.0.0.255 any" 3. Test - it should work You always try to get it to work without additional config. Once it's working, start putting things in one at a time so you can troubleshoot each if it breaks. You know that "A" works, but when you put "B" in, "A" stops working...no need to troubleshoot A if you know B broke it. Make sense? HTH, John
... View more
10-15-2015
04:08 AM
Finbarr, On you dialer interface, the acl 100 is blocking all traffic and that includes your return traffic. For testing, remove this acl and see if you can get out. Once you verify that, we can move forward with creating an acl that works for you. You should also change acl 199 to tie to your specific internal addresses instead of "any any". Change this to be: access-list 199 permit ip 192.168.1.0 0.0.0.255 any HTH, John
... View more
10-14-2015
04:33 PM
John, I'm not sure I understand what your question is. If your hosts are using 192.168.1.100 as their default gateway (regardless of what switch they're on), they can pull from a local pull on the switch as long as you have a scope in the 192.168.0.0/22. If you don't have one on here, you can redirect your requests to another server using a helper address on vlan 3's svi. As far as the dns-server line, you can use anything you want here as long as the host can get to it either internal or natted to the internet. HTH, John
... View more
10-14-2015
04:28 PM
Finbarr, This is a fairly common issue, so if you can post your config I'm sure someone will be able to get you up and running. If you believe it's an acl issue, you may want to remove the acl first to see if that resolves the issue. If not, then it's something else and we'll probably need the config... HTH, John
... View more
10-14-2015
04:26 PM
You should be able to use rspan. Take a look at this link: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html HTH, John
... View more
10-14-2015
02:46 PM
Can you post your config if the following doesn't help? Try this: access-list 100 permit ip 10.0.0.0 0.0.0.255 any ip nat inside source list 100 interface <wan interface> overload int <wan interface> ip nat out int <vlan interface> ip nat in The only issue that I have right now is that you said a device will handle natting. Is that in front of the router or behind? If it's in front of the router, you should assign all private addressing to the router's wan and lan side and not nat on the router. You would need a static route on your other device pointing to the wan interface of this router to get back to your 10.0.0.0/24 subnet. HTH, John
... View more
10-06-2015
11:53 AM
Thanks Joseph! So, does this mean that if the medium class will have the ability to scale the low class back if another medium flow begins? ** Edit ** Also, do you know if there's a way to see how much bandwidth a flow is taking? I don't know of a command, and netflow only shows you a total amount of data transferred... Thanks!
... View more
10-06-2015
08:20 AM
All, I had a couple more questions about qos brought up to me: Example: policy-map Test class Voice priority percent 20 class Medium bandwidth remaining percent 60 class Low bandwidth remaining percent 30 class class-default bandwidth remaining percent 10 Let's say the minimums for ease of math is Voice - 5Mb, Medium - 3Mb, Low - 2Mb, Default 1Mb on a 10Mb circuit (I know the math doesn't work...it's just for example) The policy above is close to what we use in our environment. The question that was brought up was: 1. If the Medium class has hit the guaranteed bandwidth, and it doesn't need any more than the minimum, the low class can share the bandwidth remaining. If the medium class only needs 3Mb, but the Low class needs 7Mb (to equate to the 10Mb), it would be allowed to do so? 2. If so, since there's no cap on either queue, when another flow that needs to match on the Medium class comes in, will it be able to get any bandwidth since it's met the minimum guarantee already. I'm thinking that it won't and the Low queue flow can actually saturate the circuit. 3. Just for clarification, the router will allow the lower classes to use the llq reservation if the llq is not being used, correct? Thanks! John
... View more
Labels:
10-03-2015
05:09 AM
if they only have a single path out, it makes no difference if they have a single static default route vs a bgp learned default route. The bgp process in itself takes up memory to run on the router, so having just a static route advertised may be overkill to run bgp for. If they have multipaths out, it may make sense depending on what your customer is needing to do.... HTH, John
... View more
10-02-2015
08:21 AM
Michael, CDP will go through switches. For example, if I have a Cisco --- Dell ---- Cisco, the Cisco will see the other Cisco, but it won't see the Dell. It's L2, so there's nothing to block the traffic between switches. CDP-supported equipment can read the packet and get the information out of it, whereas non-CDP equipment will happily pass it along.... HTH, John
... View more
10-02-2015
08:12 AM
I would say allow protocol 88 (eigrp) through the firewall between the two addresses. You may also try to set up unicast peering (with neighbor command) between the two routers so multicast packet doesn't get blocked... HTH, John
... View more
10-02-2015
08:09 AM
You can look for a port with more than one mac address and make the assumption that those ports have ip addresses attached... HTH, John
... View more
10-20-2015
I have no experience with Azure, so I'm not sure what the vpn is for.
I'm assuming that you're doing...
10-15-2015
Finbarr,"when I changed back to my original confit for acl199 it worked
again."This is because your ...
10-15-2015
Finbarr,On you dialer interface, the acl 100 is blocking all traffic and
that includes your return t...
10-14-2015
John,I'm not sure I understand what your question is. If your hosts are
using 192.168.1.100 as their...
10-14-2015
Finbarr,This is a fairly common issue, so if you can post your config
I'm sure someone will be able ...
10-14-2015
You should be able to use rspan. Take a look at this
link:http://www.cisco.com/c/en/us/td/docs/switc...
10-14-2015
Can you post your config if the following doesn't help? Try
this:access-list 100 permit ip 10.0.0.0 ...
10-06-2015
Thanks Joseph! So, does this mean that if the medium class will have the
ability to scale the low cl...
10-06-2015
All,I had a couple more questions about qos brought up to
me:Example:policy-map Testclass Voiceprior...
10-03-2015
if they only have a single path out, it makes no difference if they have
a single static default rou...
10-02-2015
Michael,CDP will go through switches. For example, if I have a Cisco ---
Dell ---- Cisco, the Cisco ...
10-02-2015
I would say allow protocol 88 (eigrp) through the firewall between the
two addresses. You may also t...
Public Statistics
| Date Registered | 05-27-2005 10:49 AM |
| Date Last Visited | 08-18-2017 06:46 PM |
| Total Messages Posted | 5,470 |
| Total Helpful Votes Received | 3473 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 133 | |
| 356 | |
| 83 | |
| 5 | |
| 53 |
.jpg "VIP Expert"){kind=icon}
.jpg "Hall of Fame Guru"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
Awards
Cisco Designated VIPs
2015 LAN WAN
Cisco Designated VIPs
2014 WAN
Cisco Designated VIPs
2013 LAN WAN
Community Spotlight Award
Members Choice November 2012
