Hello, I have a customer who wish to replace an old 7200 router that supports the following services: - 5000 static nat with support to 15000 nat translations in the near future. - Around 125 Mbps of bandwidth throughput - 200 VRFs This customer wants an security focused device and not use a router anymore because he wants to apply specific security policies for traffic entering and leaving his network plus content filtering. Also wants a scheme of HA and wants to keep the VRFs. Now I thought about a couple of  firewall ASA 5585-X in failover, but I have some questions: 1.- Does the ASA support VRFs? I have been looking around on Internet and it seems that it does not, only virtual context. 2.- What could be a potential Cisco device I could offer that complies with the requirements? maybe an ASR 1000, but again this would be replacing a router with other router which is not desired in the first place and also I will lose the HA feature.   Any advice would be appreciated. Best regards,   Rafael.   ... View more

Dear Support Commmunity,   I just got this new Cisco UCS C220-M3S where I should install a Cisco MATE and it requieres Redhat Enterprise Server 6.5. I also got the Cisco PAK for RedHat. I registered in the RedHat customer Portal, but I have not option to download the OS software because I need to activate it before download. The PAK is useless for activating the RedHat suscription, so the question is... what should I do with this PAK to be able to suscribe in RedHat and finally download the software?   Best Regards,   Roberto López.     ... View more

Dear support,   I have five hundred 7942 phones all of the with extension mobility service bound and enabled. The five hundred phones are distributed among 5 different departments. I need to constrain extension  mobility within each department to avoid users from one department to login into a phone from another department and make calls. Is there a way to achieve this requirement? My CUCM version is 9.1. Best Regards, Roberto. ... View more

Dear Experts, I am trying to setup two ezvpns to two diferent ip addresses configured on vlans in a Cisco ASA firewall. In the physical interface facing the Internet I have the following configuration: interface ethernet 0/0      description To INTERNET      no nameif      no security-level      no ip address ! interface ethernet 0/0.10      vlan 10      nameif Outside      security-level 0      ip address 150.1.39.9 255.255.255.0 ! interface ethernet 0/0.20      vlan 20      nameif Outside2      security-level 0      ip address 160.1.39.9 255.255.255.0 The problem is that the VPN (using cisco vpn client from a remote PC) work fine when connecting to the ip address of the Outside Interface (150.1.39.9) but it does not work when connecting to the ip address of the Outside2 interface (160.1.39.9). The ASA has a route to the source address of the tunnel via the Outside interface, because of that I get the following error when connecting to the ip address of the Outside subinterface: “Routing failed to locate next hop for icmp from Outside2:160.1.39.9 to Outside2:150.1.122.12”. The 150.1.122.12 is the ip address of the WinXP machine initiating the VPN. Is clear the reason of the failure but I want to know if there is a way a allow the traffic to enter Outside2 and use the route via Outside to complete the VPN. I already applied the commands: "same-security-traffic permit inter-interface" and "same-security-traffic intra-interface" but it does not work. If I create a static route to find the 150.1.122.0 /24 via Outside 2 then communication works but as expected the VPN using the Outside interface stops working. Any help will be greatly appreciated. I have attached a network diagram with some additional information. Best Regards, Roberto. ... View more