Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About julomban
Stats
Member since
11-27-2008
152
Posts
84
Helpful
27
Solutions
Created by
julomban
in Cisco Bug Discussions
in Cisco Bug Discussions
11-21-2014
08:03 AM
11-21-2014
08:03 AM
Hello Everyone, I have a related question about this bug but for the "aaa accounting {serial | telnet | ssh | enable} console server-tag". So for each context I need to check that accounting is enabled for serial, telnet, ssh and enable. If the ASA uses multiple contexts would those contexts have an individual "aaa accounting serial" command or would the serial accounting just be on the main (system) context? As per doc, the command is done per context. So on an ASA with multiple contexts enabled and from a serial connection, I login automatically to the system or admin context, then “changeto context” and both of those sequences/contexts can have aaa accounting enabled? Regards, Juan Lombana
... View more
Labels:
09-20-2013
04:57 AM
Can you confirm the following MAC address: 001d.a2af.380b It must be from the standby ASA, I see the echo request from your server and the last packet is a echo reply, it seems like the ASA is responding your request. Regards, Juan Lombana
... View more
09-19-2013
01:16 PM
and please do remember to mark the reply as the correct answer if it answered your question.
... View more
09-19-2013
01:11 PM
Mark, Sounds good, in your case you can use the third interface since you may need to re-configure your inside interface if using sub-interfaces. Glad I could help. Regards, Juan Lombana
... View more
09-19-2013
01:02 PM
Hello, Sorry for the late respond, is the issue still happening? If so, please collect the captures but this time with the detail option at the end so we can see the MAC addresses, example: show cap test detail Regards, Juan Lombana
... View more
09-19-2013
12:55 PM
Mark, I guess everything depends on your company requirements, if in the future you need to add more separate networks you may end up using sub-interface. As you said, moving from physical to logical will require major changes on your network, your switch must be configure as a trunk and the entire network must be re-design and you may need to re-configure the inside interface. If the network is not meant to increase, at least in the next year probably the easiest way will be to use that available interface and configure a second inside interface with the corresponding rules. Regards, Juan Lombana Please rate helpful posts.
... View more
09-19-2013
12:48 PM
Anthony, You may need to conect via console and collect the show ver and show run, the new IP range must be allowed on the HTTP commands, otherwise you wont be able to get access. Regards, Juan Lombana Please rate helpful posts.
... View more
09-18-2013
09:19 AM
Eugen, Unfortunately there is no such thing as "backup NAT", if the server becomes unresponsive you may need to manually change the NAT rule from Host1 to Host2. Hope it helps, Juan Lombana Please rate helpful posts.
... View more
08-16-2013
09:13 AM
The same way you can get/ping the primary unit should be the same way to get to the secondary box. Get a capture on teh standby unit in order to verify if the ASa itself receives the packets from the NMS device, capture below: capture test interface management match icmp host 172.18.9.6 host 10.52.190.2 Once you have the above capture you can try a ping from NMS server and issue the "show cap test" command, you can share the results wiht us.
... View more
07-17-2013
01:45 PM
Hello Juan, As far as I understand is not require, you just need mobile for OS platform compatibility. If you have specific questions on Mobile license requirements, send an e-mail to ac-mobile-license-request@cisco.com. Also, you can ask the same on the VPN forum. Regards, Juan Lombana Please rate helpful posts.
... View more
07-17-2013
01:37 PM
DNS server was probably too slow to respond, and the query was answered by another server but those packets are not blocked by the PIX.
... View more
07-17-2013
11:02 AM
Hello, Well, on the last log you sent it looks like the destination is 10.32.0.15, based on the description you only have the following statics: static (inside,outside) 10.32.0.5 10.32.0.5 netmask 255.255.255.255 0 0 static (inside,outside) 192.168.0.6 192.168.0.6 netmask 255.255.255.255 0 0 You can either add one for 10.32.0.15 or one for the entire network. Regards, Juan Lombana Please rate helpful posts.
... View more
07-17-2013
10:48 AM
Is there any particular reason why you have the following NAT rule: nat (outside) 1 172.32.1.0 255.255.255.0 outside 0 0 If not, please remove that line. Also, make the access list 101 has a access group pointiong to the outside interface. Regards, Juan Lombana Please rate helpful posts.
... View more
07-17-2013
10:34 AM
Instead of using ACL, use the match protocol command. This will allow the dynamic ports that need to opened for the FTP session. Regards, Juan Lombana Please rate helpful posts.
... View more
07-17-2013
08:30 AM
Eddie, This is not a bug, it is expected, there is no problem with the access list. If you have both there is no way to block port 21, indeed the same ACL allows both packets but for different flows, one hitting the port forwarding and the other hitting the one to one NAT rule. Regards, Juan Lombana Please rate helpful posts.
... View more
11-21-2014
Hello Everyone,I have a related question about this bug but for the "aaa
accounting {serial | telnet...
09-20-2013
Can you confirm the following MAC address:001d.a2af.380bIt must be from
the standby ASA, I see the e...
09-19-2013
Hello, Sorry for the late respond, is the issue still happening? If so,
please collect the captures ...
09-19-2013
Anthony,You may need to conect via console and collect the show ver and
show run, the new IP range m...
09-18-2013
Eugen,Unfortunately there is no such thing as "backup NAT", if the
server becomes unresponsive you m...
08-16-2013
The same way you can get/ping the primary unit should be the same way to
get to the secondary box. G...
07-17-2013
Hello Juan,As far as I understand is not require, you just need mobile
for OS platform compatibility...
07-17-2013
Instead of using ACL, use the match protocol command. This will allow
the dynamic ports that need to...
Public Statistics
| Date Registered | 11-27-2008 03:34 PM |
| Date Last Visited | 08-18-2017 04:03 AM |
| Total Messages Posted | 152 |
| Total Helpful Votes Received | 84 |
Helpful Votes From
| User | Helpful Count |
|---|---|
| 1 | |
| 5 | |
| 3 | |
| 3 | |
| 5 |
