Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About bturner
09-09-2019
Stats
Member since
11-23-2005
21
Posts
5
Helpful
3
Solutions
09-04-2019
07:43 AM
After upgrading to Catalyst 9500 core / distribution switches, we were excited to get FNF into the management tool. Initially on 16.11.1 code, we noticed that all interfaces in the FNF tables were listed as Null, which the management tool LiveAction detects as traffic to / from Null0 interface. After a TAC case we were told that 16.12.1 resolves this bug. CSCvm33593 - Interface input/output values show as "Null" in flow cache
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm33593/?reffering_site=dumpcr
CSCvo09803 - cat9500 interface input/output values shows as "Null" in the flow cache
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvo09803/?reffering_site=dumpcr Now on 16.12.1, we at least see traffic flowing in / out of interfaces, but all of that traffic is destined to or coming from interface Null0. The configuration matches on output interface, and collects input interface, yet the switch is not collecting the interface on the flows as you can see below : CORE1-9532QC#show flow monitor LIVEACTION-FLOWMONITOR-EGRESS cache
Cache type: Normal (Platform cache)
Cache size: 10000
Current entries: 16232
Flows added: 155034484
Flows aged: 155018252
- Active timeout ( 60 secs) 8847467
- Inactive timeout ( 10 secs) 146170785
IPV4 SRC ADDR IPV4 DST ADDR TRNS SRC PORT TRNS DST PORT INTF OUTPUT FLOW DIRN IP TOS IP PROT tcp flags intf input bytes long pkts long time abs first time abs last bytes layer2 long
=============== =============== ============= ============= ==================== ========= ====== ======= ========= ==================== ==================== ==================== ============== ============= ====================
10.1.2.3 198.18.1.1 123 123 Po1 Output 0xC0 17 0x00 Null 304 4 07:58:19.657 07:58:25.657 376
10.1.2.3 198.18.1.1 123 123 Po1 Output 0x00 17 0x00 Null 76 1 07:58:29.657 07:58:29.657 94
10.1.2.3 198.18.1.1 0 0 Po1 Output 0xC0 1 0x00 Null 952 17 07:58:03.657 07:58:35.657 1258
10.1.2.3 198.18.1.1 0 0 Po1 Output 0x00 47 0x00 Null 35441800 124619 07:57:37.657 07:58:36.657 37684942
10.1.2.3 198.18.1.1 50107 443 Fo1/0/15 Output 0x00 6 0x10 Null 50 1 07:58:27.657 07:58:27.657 68
10.1.2.3 198.18.1.1 443 54979 Fo1/0/3 Output 0x00 6 0x18 Null 83 1 07:58:36.657 07:58:36.657 101
10.1.2.3 198.18.1.1 51807 443 Fo1/0/15 Output 0x00 6 0x11 Null 100 2 07:58:35.657 07:58:35.657 136
10.1.2.3 198.18.1.1 554 56525 Fo1/0/3 Output 0x00 6 0x18 Null 8982014 6111 07:58:08.657 07:58:36.657 9092012 Our netflow record configuration is as follows : flow record LIVEACTION-FLOWRECORD-INGRESS
description DO NOT MODIFY. USED BY LIVEACTION.
match flow direction
match interface input
match ipv4 destination address
match ipv4 protocol
match ipv4 source address
match ipv4 tos
match transport destination-port
match transport source-port
collect counter bytes layer2 long
collect counter bytes long
collect counter packets long
collect interface output
collect timestamp absolute first
collect timestamp absolute last
collect transport tcp flags
flow record LIVEACTION-FLOWRECORD-EGRESS
description DO NOT MODIFY. USED BY LIVEACTION.
match flow direction
match interface output
match ipv4 destination address
match ipv4 protocol
match ipv4 source address
match ipv4 tos
match transport destination-port
match transport source-port
collect counter bytes layer2 long
collect counter bytes long
collect counter packets long
collect interface input
collect timestamp absolute first
collect timestamp absolute last
collect transport tcp flags The problem is two fold. It is difficult to stitch together the flows if you do not know source / destination interface, and the management software is interpreting Null as Null0. If there is no plan to fix this then the configuration to collect the non indexed interface for source or destination should leave the field blank or reference something other than the well known interface name of Null. Ideally some future version of software will resolve this issue as well. Has anyone else run into this? Are the developers aware of the issue? FNF is not very helpful if it cannot provide the basic function of source / destination interface. The resulting display of the flows looks like everything is talking to Null0
... View more
- Tags:
- fnf
Labels:
04-03-2017
08:07 AM
Someone MARK this guy as having solved the issue, so we can stop with the repeats of the same ANSWER please.
UPGRADE TO 8.3 or DOWNGRADE to 8.1
WHY CISCO is 8.2 RECOMMENDED on your DOWNLOAD PAGE PULL THE VERSION!
... View more
07-10-2015
08:26 AM
Yep same issue here, upgraded the device package on my CCM so it would support the new 7821's and all of my 8945's are down. We had them on 9-2-3-5 previously. I reset one of them to pull 9-2-3-5 so I could troubleshoot and this is what I'm seeing trust list update fails over and over. I've reset security and same thing is happening. Surely someone at Cisco knows the fix here, I can't get these phones to upgrade to the 9.4.2 code or whatever is latest we installed on CCM.
... View more
07-14-2013
08:09 AM
Narinder, your problem is most likely different than the original poster. Your debug shows that outbound dialpeer matches 101, after matching destination 6000, which is maybe your plar config for the trunk Group? Do you however have a dialpeer which matches incoming from the trunk group? It may seem redundant in that you are telling plar to match 101 via dialed number 6000. However before it matches on the PLAR there needs to be a incoming dial peer match for the voice port. dial-peer voice 100 pots trunkgroup pstn description ** Incoming PSTN DialPeer ** incoming called-number . !
... View more
01-18-2013
04:48 PM
Yes in 8.6 you can set the max calls per line and busy trigger to values much higher than before. However the phone itself will not allow you to interact with those additional line appearances.. For example if you have a 69xx phone and you set the line to 4 calls and 2 calls trigger busy, you will be able to transfer / conference, and receive a 2nd call. Only problem is you won't have an answer / divert softkey when the 2nd call comes in, and you won't be able to navigate between calls to select the call you wish to resume. So thanks Cisco, it seems you have only half way resolved this issue. Either allow us to assign the same DN to multiple button on a phone, or allow us to navigate within the lines of a single button. Otherwise we are forced to create phantom partitions and complicated forwarding rules.
... View more
Created by
bturner
in VPN and AnyConnect
in VPN and AnyConnect
09-07-2012
10:01 AM
09-07-2012
10:01 AM
This appears to be a Windows 7 "Feature" where the latest network interface to make a connection is moved to the top of the binding order, as Windows assumes it has better information than the previous connection. Otherwise why would you have connected in the first place right? We are having a similar issue with a client who has an application which when run binds to the NIC highest in the binding order and then uses that MAC address for licensing. Since the app is only run by 3 devices, we are issuing PCF files and Ipsec VPN for those users as the IPsec VPN falls into windows "VPN Client Adapters" pool of nics on the binding order, and doesn't change when it connects or disconnects. I can see why Cisco wanted Anyconnect outside that pool, so it would have a higher level of control over the PC and prevent the user from bypassing security by using a higher bound nic card if you deployed the BYOD / Mobility Solution. There is a setting on the ASA to allow you to run a script on connect, under the anyconnect customization / script in ASDM. Looks like a windows script file might allow you to make a change to this binding order, only issue with that is that we would have to know the UID or whatever for the device in order to create the registry key change for each user, and if they connect form another device we might well break that device by making registry changes to it. Any comment from Cisco Employee's or Anyconnect Dev / Support team would be appreciated.
... View more
Created by
bturner
in IP Telephony and Phones
in IP Telephony and Phones
08-14-2012
06:24 PM
08-14-2012
06:24 PM
I had the same issue today on a cluster I just installed. We had a 3rd CCM server shut down, because it is going to be moved next week, and the corporate directory was slow. Users complained. One of the Admins turned the 3rd server back on, and the problem went away. I'm on version 8.6.2.21900-5, which is 1 rev from being the absolute latest version.
... View more
Created by
bturner
in IP Telephony and Phones
in IP Telephony and Phones
06-26-2012
09:33 AM
06-26-2012
09:33 AM
I have been playing around with the voice class custom CPTones, and think I have found a good configuration : voice class custom-cptone conf-join dualtone conference frequency 1000 1500 cadence 300 50 300 50 voice class custom-cptone conf-leave dualtone conference frequency 300 900 cadence 300 50 50 50 50 50 For joins : High Frequency , 2 Tones, Longer Tone, with Brief Pause between. For leaves : Lower Frequency, 3 Tones, First Long, then 2 brief tones Try this out and see what you think, if anyone has a better tone setup let me know.
... View more
Labels:
Created by
bturner
in IP Telephony and Phones
in IP Telephony and Phones
06-26-2012
09:26 AM
06-26-2012
09:26 AM
You can add a party ad-hoc easily. Just tranfer the call to the meetme number... Example: You Setup the Meetme, and someone didn't join as they were supposed to. You grab a new line on your phone with hold / newcall or just newcall depending on softkey layout. Then you dial the party. Once you have them on the phone, you tell them to wait, and you then transfer / dial the meetme number / transfer. They are now in the meetme conference, and you can select the held meetme call and resume it. You could also instruct your secretary to do this for you, so you don't have to hold the Meetme Line while doing the phone work load.
... View more
05-01-2012
05:09 AM
Yes, your config would be like this : ip access-list extended External_VPN_access permit tcp host 192.168.1.150 eq 1723 any ! route-map External_VPN permit 10 match ip address External_VPN_access set ip next-hop 192.168.1.101 ! interface GigabitEthernet 0/0 ip local route-map External_VPN no ip redirects ! ip route 0.0.0.0 0.0.0.0 192.168.1.100 ip route 0.0.0.0 0.0.0.0 192.168.1.101
... View more
04-30-2012
10:20 PM
1. in your scheme, the traffic destination is not the router. so a local policy map, will never match traffic sourced from another device, even if it passes through the routrer. you would need a normal policy map on the interface. to match that traffic. remember that ip local policy map only affects traffic from the cpu of the router itself, which is why it works from SSH, to the router, but not pptp through the router. there are many gotcha's in your design, and it is very different than the topic here. you should describe what you want to do, and what challenges you are facing with it. i dont really see that the router has much of a roll there
... View more
04-30-2012
11:25 AM
ip access-list extended External_Manager_Traffic permit tcp host 30.20.10.1 eq 22 any permit icmp host 30.20.10.1 any echo-reply My ACL here clearly states to permit return traffic for SSH sessions towards 30.20.10.1. It doesn't state traffic destined to 30.20.10.1 on port 22, it says RETURN Traffic Correct version as I have it: permit tcp host 30.20.10.1 eq 22 any Incorrect verion as you describe wouldn't work : permit tcp host 30.20.10.1 any eq 22 The port 22 I'm matching on is for the Source Host TCP port, not the destination host TCP port. Its working in production using this config. I really don't have time to do a drawing. The IP addresses I've changed from production for obvious reasons.
... View more
04-23-2012
12:21 PM
I did Lab it up... So to speak, or needed this same function on my router, so I tested both ways: Code : C2900-UNIVERSALK9-M), Version 15.1(4)M3 Scenario : I have a default gateway on my 2900 router through an ASA firewall. I need to be able to SSH to the router, on an external interface, but it uses the ASA for default traffic, so I can either VPN in, and then SSH or implement this work around. Work Arround Implemented : ip access-list extended External_Manager_Traffic permit tcp host 30.20.10.1 eq 22 any permit icmp host 30.20.10.1 any echo-reply ! route-map External_Management permit 10 match ip address External_Manager_Traffic set ip next-hop 30.20.10.2 ! ISP Gateway ! ip route 0.0.0.0 0.0.0.0 10.31.120.254 ! interface GigabitEthernet0/1 description Sip and VPN interface ip address 30.20.10.1 255.255.255.0 ! ip local policy route-map External_Management I tried putting the policy-map on the gig 0/1 interface, but it didn't work. The router hasn't yet decided the traffic needs to go anywhere when it hits the interface. It then is sent to CPU and CPU uses routing table to lookup and send to default route. By Adding the Local Policy route-map we tell the CPU to apply this route map to traffic exiting the CPU. In this case we bypass the routing table and set the next hop, which triggers routing table lookup for the next hop rather than for the ultimate destination.
... View more
Created by
bturner
in Small Business Wireless
in Small Business Wireless
09-29-2011
08:12 PM
09-29-2011
08:12 PM
I am currently working with a Korean company who has mistakenly purchased 16 of these units rather than 1042, or 1142 enterprise access points. They have been trying to get them to work for weeks. I have 4 of them sitting on the floor, and you can upgrade to latest software, then reset to factory, and the default SSID's will come on and then turn back off repeatedly. I am going through all the settings now to find if there is a setting that will resolve this issue. Some of the AP's are working, or will work if you leave them alone. However if you make any changes to the config. The wireless radio will start to go up and down again. I believe there is an issue with the driver on the wireless adapter cisco is using, however they should have tested this in the lab before shipping to customers. Numerous reviews on the internet have indicated similar issues. Some people say setting it for 5GHZ N will work, but I believe this is simply luck of the draw. I believe Cisco should Recall this product.
... View more
04-03-2017
Someone MARK this guy as having solved the issue, so we can stop with
the repeats of the same ANSWER...
07-10-2015
Yep same issue here, upgraded the device package on my CCM so it would
support the new 7821's and al...
11-10-2014
Okay let me clarify. If this is for internal users, you have two options
on the ASA :Option1: Anycon...
11-09-2014
Firepower has to be installed on the new ASA X series. 5512x, 5515x,
5525x, etc. If you have a 5510,...
07-14-2013
Narinder, your problem is most likely different than the original
poster.Your debug shows that outbo...
01-18-2013
Yes in 8.6 you can set the max calls per line and busy trigger to values
much higher than before.How...
09-07-2012
This appears to be a Windows 7 "Feature" where the latest network
interface to make a connection is ...
08-31-2012
Thanks Laura, thats good amunition when fighting against the Microsoft
wave going around lately.
Created by
bturner
in IP Telephony and Phones
08-14-2012
08-14-2012
I had the same issue today on a cluster I just installed. We had a 3rd
CCM server shut down, because...
Created by
bturner
in IP Telephony and Phones
06-26-2012
06-26-2012
I have been playing around with the voice class custom CPTones, and
think I have found a good config...
06-26-2012
You can add a party ad-hoc easily. Just tranfer the call to the meetme
number... Example:You Setup t...
Public Statistics
| Date Registered | 11-23-2005 08:41 AM |
| Date Last Visited | 09-09-2019 01:34 AM |
| Total Messages Posted | 21 |
| Total Helpful Votes Received | 5 |
.jpg "Hall of Fame Expert"){kind=icon}
