Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Lemon Lime
Stats
Member since
07-01-2013
22
Posts
0
Helpful
0
Solutions
07-29-2016
06:25 AM
I am attempting to configure broadcasting from network segment to another. This has been working in the past but since we upgrade some technology (from unix to Windows platforms) it is not working.
Essentially I want UDP traffic on port 3000 which originates from IP 172.20.1.4/16 to be received by host 192.168.25.107. Both are connected directly to a 1941 Router.
I have attempted many configuration changes, with no luck. Here is my current configuration:
interface GigabitEthernet0/0 ip address 172.20.1.1 255.255.0.0 ip directed-broadcast 103 duplex auto speed auto no cdp enable ! interface GigabitEthernet0/1 ip address 192.168.250.40 255.255.255.0 duplex auto speed auto no cdp enable ! interface GigabitEthernet0/0/0 ip address 192.168.25.1 255.255.255.0 ip access-group 102 in ip helper-address 172.20.1.4 ip directed-broadcast 103 ip accounting output-packets duplex auto speed auto no cdp enable ! interface GigabitEthernet0/1/0 ip address 192.168.102.1 255.255.255.0 ip access-group 109 in duplex auto speed auto no cdp enable ! ip forward-protocol nd ip forward-protocol udp 3000 ! no ip http server no ip http secure-server ! ip route profile ! access-list 101 permit tcp host 10.2.0.97 any eq 3310 access-list 101 permit udp host 10.2.0.97 any eq 3310 access-list 101 permit icmp any any access-list 101 deny ip any any access-list 102 permit udp 192.168.25.0 0.0.0.255 any eq 3000 access-list 102 permit icmp any any access-list 102 deny ip any any access-list 103 permit udp host 172.20.1.4 any eq 3000 access-list 108 permit udp host 192.168.101.10 any eq 3320 access-list 108 permit tcp host 192.168.101.10 any eq 3320 access-list 108 permit icmp any any access-list 108 deny ip any any access-list 109 permit udp host 192.168.102.10 any eq 3320 access-list 109 permit tcp host 192.168.102.10 any eq 3320 access-list 109 permit icmp any any access-list 109 deny ip any any access-list 120 permit ip any any access-list 122 permit udp 192.168.25.0 0.0.0.255 any eq 3000 access-list 122 permit icmp any any access-list 123 permit udp host 172.20.1.4 any eq 3000 access-list 133 permit ip host 172.20.1.4 192.168.25.0 0.0.0.255 no cdp run ! ! ! control-plane ! ! ! ! end
Any ideas?
... View more
Labels:
Created by
Lemon Lime
in Small Business Switches
in Small Business Switches
09-28-2015
08:13 AM
09-28-2015
08:13 AM
I have two SG500-52 switches which are stacked. I have been trying to upgrade to the latest firmware but it is not working. The boot version is Unit SW version Boot version HW version ------------------- ------------------- ------------------- ------------------- 1 1.3.5.58 1.3.0.03 V02 2 1.3.5.58 1.3.0.03 V02 The firmware is loaded but if I reboot the switch to use the latest version (Image-1) it loads with the older version: Unit Image Filename Version Date Status ---- ----- --------- --------- --------------------- ----------- 1 1 image-1 1.4.1.3 29-Mar-2015 16:25:55 Not active 1 2 image-2 1.3.5.58 10-Oct-2013 17:17:15 Active* 2 1 image-1 1.3.0.62 02-May-2013 14:56:31 Not active 2 2 image-2 1.3.5.58 10-Oct-2013 17:17:15 Active* I have attempted to upload the latest boot version by copying the .rfb file via tftp. When I reboot the switch though it still loads the older version. Any ideas?
... View more
- Tags:
- sg500
Labels:
07-26-2015
07:01 AM
Thank you for your input. Thankfully I have since discovered that the admin who changed the password must not have done a wr mem as when I rebooted the switch I was then able to login with previous credentials. Phew!!
... View more
07-22-2015
03:57 PM
I have a Cisco SG500-52 (not PoE) switch stacked (2 switches total). The password has been forgotten for the switch. I have repeatedly attempted to access this switch via the console but I am not getting anything appear in the console window. I powered of the secondary switch, connected my serial cable to the master switch with the correct settings (115200 baud etc) and then powered cycled the master switch. I am getting nothing but a black screen. I tested the cable connecting to another device and it worked instantly. I cannot get into the switch at all. Interestingly I have another SG500-52 switch in another location, I tried to console into that also and had the same results. Any ideas?
... View more
Labels:
Created by
Lemon Lime
in Network Security
in Network Security
02-28-2014
07:25 PM
02-28-2014
07:25 PM
Thank you for your response. I'm going to rate your answer as correct but there was a line you were missing that I believe was the initial problem all along. What I had forgotten was to apply the access list to the outside interface: access-group outside_access in interface outside Once I did this it worked!! PS: Anyone in future looking at this - You will also need to ensure your http server enable is on a separate port using command http server enable port-number
... View more
Created by
Lemon Lime
in Network Security
in Network Security
02-27-2014
01:30 PM
02-27-2014
01:30 PM
Hello, I feel that this should be straight forward but I am having a lot of trouble getting this to work. I am using v8.2 (security plus license) and have an ASA which does the standard allow internal access outside but I also have an additional network which is accessed with AnyConnect client. I now have another requirement to place a web service so it is publically accessible. I only have 1 available IP address which is the outside IP of my ASA (I cannot get anymore). I though I could achieve this with port forwarding so if I chose to go to my IP with a :portnumber I could forward that traffic to my internal server. Is this correct. Example: Outside World ------------- Outside ASA / Inside ASA --------------------- Web Server 0.0.0.0 1.1.1.1 192.168.1.1 192.168.1.2 What I would like to do is enter the outside IP of my ASA into a browser with a random port and that redirects to my internal server (e.g. http://1.1.1.1:55000 redirects to https://192.168.1.2 Additional Criteria 1. I must not affect current services including my VPN connections 2. I may have additional web servers in future which will have to also use same outside IP address. Can this be done and if so, how?
... View more
Labels:
07-23-2013
10:08 PM
Ignore me, I'm talimg rubbish. I don't normally set my transform-set like that so it through me. Let's go back to the beginning. Are the ASAs even trying to talk? Run the debug commands: debug crypto isakmp 7 debug crypto ipsec 7
... View more
07-23-2013
08:53 PM
This may help you: http://www.cisco.com/en/US/docs/security/wsa/wsa7.0/user_guide/AnyConnect_Secure_Mobility_SolutionGuide.pdf Look at the paragraphs describing WSA and Proxys. In my experience though the cost and time needed to implement solutions like this for remote users are excessive. AnyConnect has websecurity modules which may better suit your purpose.
... View more
07-23-2013
08:25 PM
You're missing the object name in this line: crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac It should read: crypto ipsec transform-set outside_map ESP-3DES-SHA esp-3des esp-sha-hma Also can you ping the outside interfaces of your appliances from each other? Are they behind any other firewalls or NAT devices?
... View more
07-23-2013
08:05 PM
I believe this is your problem. Your clients should be on a different subnet range. You will need to create ACLs which ensure you don't have any NAT happening between the subnets and link those to a nat command. e.g. Client range 192.168.4.x Inside range 192.168.2.x access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.4.0 255.255.255.0 nat (inside) 0 access-list nonat http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808efbd2.shtml#step7
... View more
07-23-2013
05:48 AM
Whats the subnet range of the "clients" connecting? I don't see any routes.
... View more
07-23-2013
05:30 AM
Unforunately that link is for an unresolved DHCP problem. I have seen that it might be possible to send DHCP requests over a VPN (although lordy knows why anyone would even want to do that) but not many working examples. Besides, its not DHCP requests I'm trying to resolve. The broadcast traffic I would like my client to see is DIS traffic which is a straight broadcast UDP protocol.
... View more
07-23-2013
02:07 AM
I have a client connecting to a portion of my network using AnyConnect. This is working fine, client connects to my ASA5505 and access network resources. What I need to be able to do (for long and boring reasons) is allow the client to "see" the broadcast traffic that is happening on the internal network. Is this possible or is the ASA and the VPN tunnel simply going to not allow this? Many thanks for any help in advance.
... View more
Labels:
07-02-2013
03:48 PM
Nothing appeared on the 1941 when pinging anything on the other side of the device, which lead me to believe it was a ASA firewall issue. I have it working. I did some research and playing around and for anyone else who looks at this in future I added these two lines to my config: access-list outside_access_in extended permit ip 192.168.201.0 255.255.255.0 192.168.8.0 255.255.255.0 access-group outside_access_in in interface outside ----------- Karsten, many thanks for your help. You Sir are a Gentleman and a scholar or as the kids say "you da man".
... View more
Public Statistics
| Date Registered | 07-01-2013 09:19 PM |
| Date Last Visited | 09-21-2018 11:00 AM |
| Total Messages Posted | 22 |
.jpg "Hall of Fame Master"){kind=icon}
