Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About lkadlik
02-19-2019
Stats
Member since
11-02-2001
161
Posts
5
Helpful
0
Solutions
Created by
lkadlik
in Other Network Architecture Subjects
in Other Network Architecture Subjects
02-09-2019
10:54 AM
02-09-2019
10:54 AM
Is it possible to nat traffic coming from a particular ip block to the ip address of the inside interface it egresses?
Ex. Say my source address block was 65.55.43.0/24 > 40.54.67.8 ( this is the public ip address that nats to 10.10.10.4).
In this example the 10.10.10.4 address is the ip address that ultimately is my destination . The gateway ( inside interface ip ) for this server is 10.10.10.1.
When my traffic egresses the inside interface going to the 10.10.10.4 address i want it to appear as if its source is 10.10.101 to the 10.10.10.4 address.
Can i do this on a context asa running asa version 9.8 asdm 7.9?
This would need to work for any address on the 10.10.10.0/24 block.
I also need he same thing to work when traffic from 65.55.43.0/24 going to anything on say 172.16.5.0/24.
... View more
Labels:
Created by
lkadlik
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
11-16-2017
02:45 PM
11-16-2017
02:45 PM
Do you need additional licenses to use firepower if you purchased FS-VMW-2-SW-K9?
For example do you need other licenses for the subscriptions ?
... View more
08-17-2017
04:15 PM
Hi,
I have a cisco 5585, software version 9.5(2)2 running in context mode.
Could someone please tell me the maximum number of objects I can have in a single context firewall, the maximum number of objects I can have in an object group in a single context firewall and how many object groups I can have in each acl?
Also, is it possible to block IP address ranges by geographical region versus ip host or cidr block addresses?
Thank you.
... View more
Labels:
04-18-2017
10:10 AM
Here it is:
interface TenGigabitEthernet1/1/3 description uplink to switchport trunk allowed vlan 1120,2120 switchport mode trunk udld port aggressive channel-group 20 mode active service-policy output pmap-10G-out class-map match-any video description matches video traffic af41 match ip dscp af41 match ip dscp af42 class-map match-any voice match ip dscp ef match ip dscp cs5 policy-map pmap-10G-out class voice priority level 1 percent 1 class video priority level 2 percent 2
... View more
04-17-2017
08:03 AM
Hi,
I do not see any drops in the following output except for the ones on the network port. Could someone please tell me what these drops represent and if it is an issue?
The switch stack is 3650s and running code - 3.06.06E
sh platform qos queue stat te 1/1/3 DATA Port:0 Enqueue Counters ------------------------------- Queue Buffers Enqueue-TH0 Enqueue-TH1 Enqueue-TH2 ----- ------- ----------- ----------- ----------- 0 0 0 0 13753783225 1 0 0 0 53963041 2 0 0 0 17810121481 3 0 0 0 0 4 0 0 0 0 5 0 0 0 0 6 0 0 0 0 7 0 0 0 0 DATA Port:0 Drop Counters ------------------------------- Queue Drop-TH0 Drop-TH1 Drop-TH2 SBufDrop QebDrop ----- ----------- ----------- ----------- ----------- ----------- 0 0 0 0 0 0 1 0 0 0 0 0 2 0 0 0 0 0 3 0 0 0 0 0 4 0 0 0 0 0 5 0 0 0 0 0 6 0 0 0 0 0 7 0 0 0 0 0 AQM Broadcast Early WTD COUNTERS(In terms of Bytes) -------------------------------------------------- PORT TYPE ENQUEUE DROP -------------------------------------------------- UPLINK PORT-0 N/A 0 UPLINK PORT-1 N/A 0 UPLINK PORT-2 N/A 0 UPLINK PORT-3 N/A 0 NETWORK PORTS 261 261 RCP PORTS 0 0 CPU PORT 0 0 Note: Queuing stats are in bytes
Thank you.
... View more
- Tags:
- 3650
- qos
- sh platform
Labels:
Hi,
Thank you.
On our internal interface we have
policy-map pmap-rtrlan-in description input policy from LAN for stats and set video dscp class voice class video class net-mgmt class net-routing class critical-apps class backup-replication class class-default class-map match-any net-routing description matches routing traffic - cs6 (Default) match ip dscp cs6 class-map match-any net-mgmt description matches net-mgmt & vty traffic in/out match ip dscp cs2 class-map match-any backup-replication description matches backup and replication traffic match access-group name backup-replication-map match access-group name mark-af11 class-map match-any video description matches video match ip dscp af41 match ip dscp af42 match ip dscp af31 match ip dscp af32 match ip dscp cs6 match ip dscp cs5 class-map match-any voice description matches voice traffic only - in or out match ip dscp ef class-map match-any critical-apps description matches critical traffic lan/wan in & out match class-map net-mgmt match access-group name mark-af21
----------------------------------------------------------------
So based on your answer, I would take the match for af41 out of the video map and create the new class map discussed and add it to the existing policy map as
policy-map pmap-rtrlan-in
class af41_to_af31 set dscp af31
correct?
Thank you
Lynne
... View more
02-19-2017
08:23 AM
Hi,
I think I know what needs to be done for this but am not 100 percent sure. The end goal is to make sure af41 packets are getting remarked to af31 going outbound to our mpls provider.
currently the following class and policy maps are configured on the asr router.
class-map match-any af31 description matches af31 from ATT match ip dscp af31 match ip dscp af32 class-map match-any video-wan-in description matches video from wan - reset dscp af41 match ip dscp af31 match ip dscp af32 class-map match-any video-mpls-out match ip dscp af31 match ip dscp cs6 match ip dscp af32 class-map match-any net-routing description matches routing traffic - cs6 (Default) match ip dscp cs6 class-map match-any net-mgmt description matches net-mgmt & vty traffic in/out match ip dscp cs2 class-map match-any backup-replication description matches backup and replication traffic match access-group name backup-replication-map match access-group name mark-af11 class-map match-any video description matches video match ip dscp af41 match ip dscp af42 match ip dscp af31 match ip dscp af32 match ip dscp cs6 match ip dscp cs5 class-map match-any voice description matches voice traffic only - in or out match ip dscp ef class-map match-any video/net-lan-out description matches video and routing traffic lan out match ip dscp af41 match ip dscp af42 match class-map net-routing match ip dscp af31 class-map match-any critical-apps description matches critical traffic lan/wan in & out match class-map net-mgmt match access-group name mark-af21 class-map match-any video/net-mpls-out description matches video and network/routing traffic mpls out match ip dscp af31 match ip dscp af32 match class-map net-routing class-map match-any critical-apps-in/out description matches critical traffic lan/wan in & out match ip dscp af21 match ip dscp af22 match class-map net-mgmt class-map match-all remark-ftp-af11 description matches critical traffic af21/22 and remarks af11 match class-map critical-apps-in/out match protocol ftp ! policy-map pmap-wan-in description input policy from wan, for stats only class voice class video class net-mgmt class net-routing class critical-apps class backup-replication class class-default policy-map pmap-wan-out class voice priority level 1 47500 class video priority level 2 119000 class af31 bandwidth remaining percent 40 random-detect dscp-based class critical-apps bandwidth remaining percent 30 random-detect dscp-based class backup-replication bandwidth remaining percent 10 random-detect dscp-based fair-queue class class-default random-detect dscp-based fair-queue policy-map pmap-wan-gige-out description parent policy-map for shaping to CIR class class-default shape average 490000000 10000000 0 service-policy pmap-wan-out policy-map pmap-rtrlan-in description input policy from LAN for stats and set video dscp class voice class video class net-mgmt class net-routing class critical-apps class backup-replication class class-default policy-map pmap-lan-out description applied outbound on lan interface class voice priority level 1 47500 class video priority level 2 119000 class af31 bandwidth remaining percent 40 random-detect dscp-based class critical-apps bandwidth remaining percent 30 random-detect dscp-based class backup-replication bandwidth remaining percent 10 random-detect dscp-based fair-queue class class-default random-detect dscp-based fair-queue
-------
I believe the below will work to remark the packets but then it is no longer part of the 2nd priority queue. So i guess my question is will the below remark the packets? If so, is there anyway i can make it a part of the 2nd priority queue like the "video_no_af41" class is so that it participates in the same queue with the same bandwidth restriction?
class af41_to_af31 description used to remark af41 packets to af31 packets match ip dscp af41 class-map match-any video_no_af41 description matches video match ip dscp af42 match ip dscp af31 match ip dscp af32 match ip dscp cs6 match ip dscp cs5 policy-map pmap-wan-out class voice priority level 1 47500 class video_no_af41 priority level 2 119000 class af41_to_af31 set dscp af31 class af31 bandwidth remaining percent 40 random-detect dscp-based class critical-apps bandwidth remaining percent 30 random-detect dscp-based class backup-replication bandwidth remaining percent 10 random-detect dscp-based fair-queue class class-default random-detect dscp-based fair-queue
Thank you.
... View more
Labels:
02-19-2017
07:54 AM
Hi,
In the following policy-maps : For the first one, when it says "priority level 1 10000" does this mean the output of the traffic that is QOS'd is capped at 10 Megs?
In the second one does it mean it that voice is capped at 100 M?
policy-map pmap-1G-out class voice priority level 1 10000 class video priority level 2 20000 policy-map pmap-10G-out class voice priority level 1 100000 class video priority level 2 200000
... View more
- Tags:
- priority level
- qos
Labels:
01-19-2017
03:40 PM
Here is some additional output from the switch:
sh platform qos advanced qsb gigabitEthernet 1/0/1 QoS Subblock contents...iif_id: 0xc8884000000009 iif_type:146 def_cos = 0, def_cos_enable = 0, def_qos_label = 0 def_priority = 13, trust_enabled = 1 input_trans_index = 0, output_trans_index = 0 def_queuing = 0, trust_type = TRUST_DSCP Failed to get IN client LE ifm_rc:1 Failed to get OUT client LE ifm_rc:1 policy_trust = TRUST_NONE input_policy = (nil), output_policy = 0x540836c0 label_value = (nil) afd_tgt_hdl = (nil), port type = Wired port, shape_rate = 0 afd_status = UNALLOCATED num_radios 0 in_ag_1r2c_plc = 0, in_ag_2r3c_plc = 0 out_ag_1r2c_plc = 0, out_ag_2r3c_plc = 0 in_mf_plc = 0, out_mf_plc = 0 in_plc_map_index = -1 out_plc_map_index = -1 [ag_plc_handle = 0] [mf_plc_handle in,out=(nil),(nil) num:0,0 base:-1,-1 rc:0,0] afd_data.max = 0, afd_data.weight = 0 afd_rt1:police_en 0, rate 0, burst 0 afd_rt2:police_en 0, rate 0, burst 0 afd_client_max_rate = 0
sh platform qos policies port Loc Interface IIF-ID Dir Policy State --- ------------------ ------------------ --- ------------------ --------------- L:0 Te1/1/3 0x00c97b0000000072 OUT pmap-10G-out INSTALLED IN HW L:1 Gi1/0/1 0x00c8884000000009 OUT pmap-10G-out INSTALLED IN HW
qos policy target gigabitEthernet 1/0/1 Input policy : -------------- Not attached Output policy : -------------- POLICY: pmap-10G-out Tkn:260 Num Classes:3 PLC Map Targets:0 Queue LBL Targets uplink:1 downlink:1 VMRINFO: { } VMRINFO PMAP:0x540836c0 Tkn:260 NextPMAP:(nil) PrevPMAP:(nil) num_classmaps 3 nfl_req_pending_cnt:0 pmap_qsize:0 Stats debug counter: 0 CLASS: voice Tkn:263 CMAP:0x54086f28 Tkn:263 Next:0x540867f0 Prev:(nil) Masks:- UP:0, CoS: 0, Dscp:71468255805440 Filter flags 0x2 Stats debug counter: 0 Match DSCP:40 46 Negate: NO Next:(nil) CLASS: video Tkn:262 CMAP:0x540867f0 Tkn:262 Next:0x54086110 Prev:0x54086f28 Masks:- UP:0, CoS: 0, Dscp:85899345920 Filter flags 0x2 Stats debug counter: 0 Match DSCP:34 36 Negate: NO Next:(nil) CLASS: class-default Tkn:261 CMAP:0x54086110 Tkn:261 Next:(nil) Prev:0x540867f0 Masks:- UP:0, CoS: 0, Dscp:0 Filter flags 0 Stats debug counter: 0 Not Supported Negate: NO Next:(nil) L:1 Target:Gi1/0/1 Tkn:264 DIR:OUT STATE:SET IN HW LE_LABEL:0, client_policy_type:LE nfl_pend:0 IF:0x00c8884000000009 TCCGs:3 TCG:0x54087698 Tkn:264 Next:(nil) Prev:0x54088570 TCG Stats debug counter: 0 vcu_cmhandle:0xffffffff vcu_cmhandle:0xffffffff vcu_cmhandle:0xffffffff CLASS: voice Tccg-Tkn:268 Action flags:0x10 TCCG Stats debug counter: 0 Action:QUEUE Shared action obj token:258 Queue Action Buffer ratio:0 Limit Type:Queue Limit Single CLASS: video Tccg-Tkn:267 Action flags:0x10 TCCG Stats debug counter: 0 Action:QUEUE Shared action obj token:259 Queue Action Buffer ratio:0 Limit Type:Queue Limit Single CLASS: class-default Tccg-Tkn:266 Action flags:0x10 TCCG Stats debug counter: 0 Action:QUEUE Shared action obj token:257 Queue Action Buffer ratio:0 Limit Type:Queue Limit Single Hardware States **************** Additional details for policy: pmap-10G-out Number of targets attached to : 2 Number of targets policy successfully programmed in HW: 2
sh platform qos policy name pmap-10G-out detail POLICY: pmap-10G-out Tkn:260 Num Classes:3 PLC Map Targets:0 Queue LBL Targets uplink:1 downlink:1 VMRINFO: { } VMRINFO PMAP:0x540836c0 Tkn:260 NextPMAP:(nil) PrevPMAP:(nil) num_classmaps 3 nfl_req_pending_cnt:0 pmap_qsize:0 Stats debug counter: 0 CLASS: voice Tkn:263 CMAP:0x54086f28 Tkn:263 Next:0x540867f0 Prev:(nil) Masks:- UP:0, CoS: 0, Dscp:71468255805440 Filter flags 0x2 Stats debug counter: 0 Match DSCP:40 46 Negate: NO Next:(nil) CLASS: video Tkn:262 CMAP:0x540867f0 Tkn:262 Next:0x54086110 Prev:0x54086f28 Masks:- UP:0, CoS: 0, Dscp:85899345920 Filter flags 0x2 Stats debug counter: 0 Match DSCP:34 36 Negate: NO Next:(nil) CLASS: class-default Tkn:261 CMAP:0x54086110 Tkn:261 Next:(nil) Prev:0x540867f0 Masks:- UP:0, CoS: 0, Dscp:0 Filter flags 0 Stats debug counter: 0 Not Supported Negate: NO Next:(nil) L:0 Target:Te1/1/3 Tkn:269 DIR:OUT STATE:SET IN HW LE_LABEL:0, client_policy_type:LE nfl_pend:0 IF:0x00c97b0000000072 TCCGs:3 TCG:0x54088570 Tkn:269 Next:0x54087698 Prev:(nil) TCG Stats debug counter: 0 vcu_cmhandle:0xffffffff vcu_cmhandle:0xffffffff vcu_cmhandle:0xffffffff CLASS: voice Tccg-Tkn:273 Action flags:0x10 TCCG Stats debug counter: 0 Action:QUEUE Shared action obj token:276 Queue Action Buffer ratio:0 Limit Type:Queue Limit Single CLASS: video Tccg-Tkn:272 Action flags:0x10 TCCG Stats debug counter: 0 Action:QUEUE Shared action obj token:277 Queue Action Buffer ratio:0 Limit Type:Queue Limit Single CLASS: class-default Tccg-Tkn:271 Action flags:0x10 TCCG Stats debug counter: 0 Action:QUEUE Shared action obj token:275 Queue Action Buffer ratio:0 Limit Type:Queue Limit Single Hardware States **************** L:1 Target:Gi1/0/1 Tkn:264 DIR:OUT STATE:SET IN HW LE_LABEL:0, client_policy_type:LE nfl_pend:0 IF:0x00c8884000000009 TCCGs:3 TCG:0x54087698 Tkn:264 Next:(nil) Prev:0x54088570 TCG Stats debug counter: 0 vcu_cmhandle:0xffffffff vcu_cmhandle:0xffffffff vcu_cmhandle:0xffffffff CLASS: voice Tccg-Tkn:268 Action flags:0x10 TCCG Stats debug counter: 0 Action:QUEUE Shared action obj token:258 Queue Action Buffer ratio:0 Limit Type:Queue Limit Single CLASS: video Tccg-Tkn:267 Action flags:0x10 TCCG Stats debug counter: 0 Action:QUEUE Shared action obj token:259 Queue Action Buffer ratio:0 Limit Type:Queue Limit Single CLASS: class-default Tccg-Tkn:266 Action flags:0x10 TCCG Stats debug counter: 0 Action:QUEUE Shared action obj token:257 Queue Action Buffer ratio:0 Limit Type:Queue Limit Single Hardware States **************** Additional details for policy: pmap-10G-out Number of targets attached to : 2 Number of targets policy successfully programmed in HW: 2 unknown
... View more
Hi,
Unfortunately it does not show it there either. I am concerned even though I did not get an error when it went it the configuration file did not really take. I want to confirm the bandwidth I set in the policy map that was put in will be what is used.
sh policy-map pmap-10G-out Policy Map pmap-10G-out Class voice priority level 1 Class video priority level 2
... View more
01-19-2017
12:42 PM
When I put the following policy map on my 3650 it appears to take the config but when I go back and look at it the kilo bits per second value assigned does not show in the config. How can I verify that it is set appropriately?
The config I have dropped in is as follows:
policy-map pmap-10G-out class voice priority level 1 4096 class video priority level 2 50000
I am using a lan base license with the bundle for cat3k_caa-universalk9.SPA.03.06.06.E.152-2.E6.bin
Thank you.
... View more
Labels:
01-18-2017
07:02 AM
Hi,
So I read the following:
"You cannot use the switch current-stack-member-number renumber new-stack-member-number global configuration command on a provisioned switch. If you do, the command is rejected."
This made me wonder about the switch provision command. I was trying to find some more information about it without much success. I was hoping someone could tell me if it needs to be on stack, what the pros are to having it there and what the cons are of removing it off a 3650 switch stack?
command ex switch 1 provision ws-c3650-48pd
Also, I have been told when a second 1025W power supply is added to the switches in the stack it will effectively change them to the FD model. If the pd model is listed will it be an issue if a time comes when a second power supply needs to be added to the switch ?
Thank you.
... View more
Labels:
Hi,
So yes to question 1 then. Is that correct?
What happens if the active and standby switch both go down?
Thank you.
... View more
01-17-2017
09:09 AM
Hi,
I am stacking some 3650s together. After stacking them I noticed the active switch, standby switch, and member switches. I understand that the active member controls the stack and keeps the configuration file and if that switch goes down the standby switch takes over but I have a few questions.
1) The standby switch can be used like a normal switch correct ( ie all of those ports are available)?
2) What happens if both the Active and Standby switches in the stack go down? Will a member switch take over and become the active switch?
Thank you.
... View more
- Tags:
- 3650
- stack membership
Labels:
01-10-2017
11:51 AM
In the following link
http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3650-series-switches/q-and-a-c67-729531.html
It mentions that in the LAN base version of the xe software it can do:
Enterprise access QoS
Ingress policing, Trust Boundary, AutoQoS, and DSCP mapping
and in the ipbase version of the xe software it can do Complete access QoS. Could you please tell me the difference between the 2?
Thank you.
... View more
- Tags:
- qos
Labels:
Created by
lkadlik
in Other Network Architecture Subjects
02-09-2019
02-09-2019
Is it possible to nat traffic coming from a particular ip block to the
ip address of the inside inte...
Created by
lkadlik
in Intrusion Prevention and Detection Systems (IPS - IDS)
11-16-2017
11-16-2017
Do you need additional licenses to use firepower if you purchased
FS-VMW-2-SW-K9? For example do you...
08-17-2017
Hi, I have a cisco 5585, software version 9.5(2)2 running in context
mode. Could someone please tell...
04-18-2017
Here it is: interface TenGigabitEthernet1/1/3 description uplink to
switchport trunk allowed vlan 11...
04-17-2017
Hi, I do not see any drops in the following output except for the ones
on the network port. Could so...
02-19-2017
Hi, I think I know what needs to be done for this but am not 100 percent
sure. The end goal is to ma...
02-19-2017
Hi, In the following policy-maps : For the first one, when it says
"priority level 1 10000" does thi...
01-19-2017
Here is some additional output from the switch: sh platform qos advanced
qsb gigabitEthernet 1/0/1Qo...
01-19-2017
When I put the following policy map on my 3650 it appears to take the
config but when I go back and ...
01-18-2017
Hi, So I read the following: "You cannot use the switch
current-stack-member-number renumber new-sta...
01-17-2017
Hi, I am stacking some 3650s together. After stacking them I noticed the
active switch, standby swit...
Public Statistics
| Date Registered | 11-02-2001 08:07 AM |
| Date Last Visited | 02-19-2019 07:44 AM |
| Total Messages Posted | 161 |
| Total Helpful Votes Received | 5 |
Helpful Votes Given To
.jpg "VIP Advisor"){kind=icon}
.jpg "Hall of Fame Expert"){kind=icon}
