Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Jesse Shumaker
Stats
Member since
10-31-2010
152
Posts
0
Helpful
2
Solutions
Created by
Jesse Shumaker
in Routing
in Routing
03-29-2019
06:53 AM
03-29-2019
06:53 AM
I got a response from the ISP. Looks like there was no issue here. I'll close the discussion. thanks everyone. After working through the route age discrepancy at our peer with engineering, I can provide clarification. For the more recent and recurring route age refreshes, where we do not see our peer drop and also do not see a route age change from the neighbor router/AS network, this local age refresh is a result of new installs on that chassis. When completing the new internet service turnups on the ALU gateways, the local route table is refreshed. This is only observed from the local chassis and wouldn’t be affecting active routing or any other router/AS. So we don’t need to hunt for any communications associated to those age refreshes, there isn’t any. I was also able to validate the same behavior/age looking at any prefix received on any peer at the same gateway router locally. I was also able to verify that the age refresh was not transient to any other routers/networks among any of them. I’m sorry we got off track accounting for that point.
... View more
Created by
Jesse Shumaker
in Routing
in Routing
03-28-2019
02:42 PM
03-28-2019
02:42 PM
the only logs I have from the ISP are those 06h36m21s timestamps on the route age I posted in the first post. I'll find out if they can provide any more. I scrubbed the configs for the public IP's and posted the output of sh ip bgp neighbor ASR1002#sh ip bgp neighbors 55.44.66.56
BGP neighbor is 55.44.66.56, remote AS 5555, external link
Description: ISP
BGP version 4, remote router ID 55.44.66.56
BGP state = Established, up for 21w3d
Last read 00:00:04, last write 00:00:26, hold time is 90, keepalive interval is 30 seconds
Neighbor sessions:
1 active, is not multisession capable (disabled)
Neighbor capabilities:
Route refresh: advertised and received(new)
Four-octets ASN Capability: advertised and received
Address family IPv4 Unicast: advertised and received
Enhanced Refresh Capability: advertised
Multisession Capability:
Stateful switchover support enabled: NO for session 1
Message statistics:
InQ depth is 0
OutQ depth is 0
Sent Rcvd
Opens: 1 1
Notifications: 0 0
Updates: 2 48009330
Keepalives: 473147 433742
Route Refresh: 0 0
Total: 473150 48443073
Default minimum time between advertisement runs is 30 seconds
For address family: IPv4 Unicast
Session: 55.44.66.56
BGP table version 1900650436, neighbor version 1900650359/1900650436
Output queue size : 0
Index 117, Advertise bit 1
117 update-group member
My AS number is allowed for 5 number of times
Outbound path policy configured
Route map for outgoing advertisements is LOCAL_AS
Slow-peer detection is disabled
Slow-peer split-update-group dynamic is disabled
Sent Rcvd
Prefix activity: ---- ----
Prefixes Current: 2 731432 (Consumes 46811648 bytes)
Prefixes Total: 2 190657176
Implicit Withdraw: 0 182926233
Explicit Withdraw: 0 6999511
Used as bestpath: n/a 669958
Used as multipath: n/a 0
Outbound Inbound
Local Policy Denied Prefixes: -------- -------
Invalid Path: 4383188 n/a
Other Policies: 63555254 n/a
Total: 67938442 0
Number of NLRIs in the update sent: max 3, min 0
Last detected as dynamic slow peer: never
Dynamic slow peer recovered: never
Refresh Epoch: 1
Last Sent Refresh Start-of-rib: never
Last Sent Refresh End-of-rib: never
Last Received Refresh Start-of-rib: never
Last Received Refresh End-of-rib: never
Sent Rcvd
Refresh activity: ---- ----
Refresh Start-of-RIB 0 0
Refresh End-of-RIB 0 0
Address tracking is enabled, the RIB does have a route to 55.44.66.56
Connections established 47; dropped 46
Last reset 21w3d, due to Admin. shutdown of session 1
Transport(tcp) path-mtu-discovery is enabled
Graceful-Restart is disabled
Connection state is ESTAB, I/O status: 1, unread input bytes: 0
Connection is ECN Disabled
Mininum incoming TTL 0, Outgoing TTL 1
Local host: 55.44.66.55, Local port: 24079
Foreign host: 55.44.66.56, Foreign port: 179
Connection tableid (VRF): 0
Enqueued packets for retransmit: 0, input: 0 mis-ordered: 0 (0 bytes)
Event Timers (current time is 0x34B92D6571):
Timer Starts Wakeups Next
Retrans 473626 476 0x0
TimeWait 0 0 0x0
AckHold 5479230 3071178 0x0
SendWnd 0 0 0x0
KeepAlive 0 0 0x0
GiveUp 0 0 0x0
PmtuAger 1 1 0x0
DeadWait 0 0 0x0
Linger 0 0 0x0
iss: 921970404 snduna: 930960336 sndnxt: 930960336 sndwnd: 32768
irs: 1336347572 rcvnxt: 2425078609 rcvwnd: 15985 delrcvwnd: 399
SRTT: 300 ms, RTTO: 303 ms, RTV: 3 ms, KRTT: 0 ms
minRTT: 1 ms, maxRTT: 709 ms, ACK hold: 200 ms
Status Flags: none
Option Flags: higher precendence, nagle, path mtu capable, md5
Datagrams (max data segment is 1024 bytes):
Rcvd: 9252656 (out of order: 1), with data: 8781418, total data bytes: 1088731036
Sent: 6450220 (retransmit: 476 fastretransmit: 0),with data: 473149, total data bytes: 8989931
ASR1002# I will begin running these commands against my prefixes to see if I can capture any bgp events the next time this occurs. thanks Paul. access-list 100 permit ip host 1.1.1.0 host 255.255.255.0 debug ip bgp updates 100
... View more
Created by
Jesse Shumaker
in Routing
in Routing
03-26-2019
09:31 PM
03-26-2019
09:31 PM
One of my ISP's reached out to me the other day to notify me that I had unadvertised both of my /24 prefixes towards them for a millisecond, so fortunately this didn't cause any routing issues out into the Internet towards our prefixes. I checked the logs on the router and noticed nothing related to allowing this behavior and there were no engineer changes to un-advertise those prefixes towards this BGP peer. The BGP session was also established and up for over 1 year. There wasn't any CPU spikes to make BGP glitch or cause other strange behavior around this time. They also notified me that this happened on March 6th for a longer period of time and the prefix's were pulled from being advertised towards the Internet. I also have no evidence of this behavior and there were no BGP changes on my ASR to cause this behavior. Can anyone explain what may have caused this? I'm running dual ASR1002's in a multi homed scenario with dual ISP's who both advertise our /24 prefixes. thanks ===============================================================================
Route Table (Router: Base)
===============================================================================
Dest Prefix[Flags] Type Proto Age Pref
Next Hop[Interface Name] Metric
-------------------------------------------------------------------------------
1.1.1.0/24 Remote BGP 06h36m21s 170
55.44.66.56 0
-------------------------------------------------------------------------------
No. of Routes: 1
Flags: n = Number of times nexthop is repeated
B = BGP backup route available
L = LFA nexthop available
S = Sticky ECMP requested
===============================================================================
*A:bear1.phx1# show router route-table 68.106.64.0
===============================================================================
Route Table (Router: Base)
===============================================================================
Dest Prefix[Flags] Type Proto Age Pref
Next Hop[Interface Name] Metric
-------------------------------------------------------------------------------
2.2.2.0/24 Remote BGP 06h40m20s 170
55.44.66.56 0
-------------------------------------------------------------------------------
No. of Routes: 1
Flags: n = Number of times nexthop is repeated
B = BGP backup route available
L = LFA nexthop available
S = Sticky ECMP requested
===============================================================================
... View more
Labels:
Created by
Jesse Shumaker
in VPN and AnyConnect
in VPN and AnyConnect
01-29-2018
07:51 PM
01-29-2018
07:51 PM
ok should this be at all sites including this problem site or just the problem site?
isakmp keepalive threshold 10 retry 2
Apart from VPN behaviour, how is the internet access via secondary provider. You notice any discrepancy? You noticed it only after upgrading ASA to 5506 (if I remember correct model). If so, did you check for any bugs in the code you are running?
the internet is working great via 2nd provider. no issues. yes, just after upgrading to 5506. I have the latest code on:
Release 9.6.2 Interim
... View more
Created by
Jesse Shumaker
in VPN and AnyConnect
in VPN and AnyConnect
01-25-2018
08:01 PM
01-25-2018
08:01 PM
The other tunnels do clear out. I continuously run this command and see them all clear and begin establishing on the Qwet_Backup_IP. I believe this is occurring because somehow that Cox_Primary_IP is sending traffic. could the Qwet_Backup_IP tunnels be encapsulating traffic with an inner IP as the Cox_Primary_IP? this is a long stretch, just out of ideas. the default tunnel group has this keepalive enabled. Is that enough?
sh cryp isa sa tunnel-group DefaultRAGroup ipsec-attributes isakmp keepalive threshold 10 retry 2
... View more
Created by
Jesse Shumaker
in VPN and AnyConnect
in VPN and AnyConnect
01-23-2018
08:46 PM
01-23-2018
08:46 PM
very similar to this flapping site
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map VPN 1 match address Central_North_VPN_Traffic
crypto map VPN 1 set peer Cox_Primary_IP Qwest_Backup_IP
crypto map VPN 1 set ikev1 transform-set ESP-3DES-SHA crypto map VPN interface primary crypto map VPN interface secondary crypto ca trustpool policy crypto isakmp identity address crypto ikev1 enable primary crypto ikev1 enable secondary crypto ikev1 am-disable crypto ikev1 policy 1 authentication pre-share encryption 3des hash sha group 2 lifetime 28800
whats strange is phase 2 completes to the qwest_primary_ip and than there's a teardown request to from the cox_Primary_ip. .
Jan 23 19:48:30 [IKEv1]Group = Qwest_Backup_IP, IP = Qwest_Backup_IP, PHASE 2 COMPLETED (msgid=efe4e93d) Jan 23 19:48:58 [IKEv1]Group = Qwest_Backup_IP, IP = Qwest_Backup_IP, Session is being torn down. Reason: User Requested Jan 23 19:48:58 [IKEv1]Ignoring msg to mark SA with dsID 1073152 dead because SA deleted Jan 23 19:49:06 [IKEv1 DEBUG]Pitcher: received a key acquire message, spi 0x0 Jan 23 19:49:06 [IKEv1]IP = Cox_Primary_IP, IKE Initiator: New Phase 1, Intf inside, IKE Peer Cox_Primary_IP local Proxy Address 192.168.2.0, remote Proxy Address 192.168.1.0, Crypto map (VPN)
This cycle continuous of phase 2 complets and teardowns until I restore service to the Cox_PRimary_IP.
... View more
Created by
Jesse Shumaker
in VPN and AnyConnect
in VPN and AnyConnect
01-23-2018
08:19 PM
01-23-2018
08:19 PM
Here is one of the other sites. There are 5 other sites which have L2L tunnels to this flapping site.
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association pmtu-aging infinite crypto map VPN 1 match address Central_North_VPN_Traffic crypto map VPN 1 set peer [Cox_Primary_IP] [Qwest_Backup_IP] crypto map VPN 1 set ikev1 transform-set ESP-3DES-SHA crypto map VPN interface primary
crypto map VPN interface secondary crypto ca trustpool policy
crypto isakmp identity address
crypto ikev1 enable primary
crypto ikev1 enable secondary
crypto ikev1 am-disable
crypto ikev1 policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 28800 ! tunnel-group [Cox_Primary_IP] type ipsec-l2l tunnel-group [Cox_Primary_IP] ipsec-attributes ikev1 pre-shared-key ***** ! tunnel-group [Qwest_Backup_IP] type ipsec-l2l tunnel-group [Qwest_Backup_IP] ipsec-attributes ikev1 pre-shared-key *****
"If that is the case, as test remove related crypto map config when you admin down primary ISP interface."
This is a good idea and as you can see how I have the config setup. How would the tunnel request to the [Cox_Primary_IP] ever get serviced if that IP isn't reachable, since I've admined down the interface this IP belongs to? What I'm finding is the remote sites actually recieve a teardown
Here's the ip sla stats during failover tonight
Entry number: 100
Modification time: 16:16:36.033 ARIZONA Sun Jan 21 2018
Number of Octets Used by this Entry: 2056
Number of operations attempted: 16731
Number of operations skipped: 0
Current seconds left in Life: Forever
Operational state of entry: Active
Last time this entry was reset: Never
Connection loss occurred: FALSE
Timeout occurred: TRUE
Over thresholds occurred: FALSE
Latest RTT (milliseconds): NoConnection/Busy/Timeout
Latest operation start time: 14:44:46.035 ARIZONA Tue Jan 23 2018
Latest operation return code: Timeout
RTT Values:
RTTAvg: 0 RTTMin: 0 RTTMax: 0
NumOfRTT: 0 RTTSum: 0 RTTSum2: 0
Here is the data giving proof that the [Cox_Primary_IP] is still initiating a request. Somehow traffic is being generated from this IP even though the interface is down. As you can see the site with the VPN config above is receiving a a teardown request from this [Cox_Primary_IP]
PHASE 2 COMPLETEs to the Qwest_Backup_IP
Jan 23 19:48:30 [IKEv1]Group = Qwest_Backup_IP, IP = Qwest_Backup_IP, PHASE 2 COMPLETED (msgid=efe4e93d)
We see new phase 1 begin from [Cox_Primary_IP] than MSG2's which represent an unreachable connection.
Jan 23 19:48:58 [IKEv1]Group = Qwest_Backup_IP, IP = Qwest_Backup_IP, Connection terminated for peer Qwest_Backup_IP. Reason: Peer Terminate Remote Proxy 192.168.1.0, Local Proxy 192.168.2.0 Jan 23 19:48:58 [IKEv1 DEBUG]Group = Qwest_Backup_IP, IP = Qwest_Backup_IP, Active unit receives a delete event for remote peer Qwest_Backup_IP Jan 23 19:48:58 [IKEv1 DEBUG]Group = Qwest_Backup_IP , IP = Qwest_Backup_IP , IKE Deleting SA: Remote Proxy 192.168.1.0, Local Proxy 192.168.2.0 Jan 23 19:49:06 [IKEv1]IP = Cox_Primary_IP , IKE Initiator: New Phase 1, Intf inside, IKE Peer Cox_Primary_IP local Proxy Address 192.168.2.0, remote Proxy Address 192.168.1.0, Crypto map (VPN) Jan 23 19:49:38 [IKEv1 DEBUG]IP = Cox_Primary_IP , IKE MM Initiator FSM error history (struct &0x00002aaac232a9f0) <state>, <event>: MM_DONE, EV_ERROR-->MM_WAIT_MSG2, EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_MSG-->MM_WAIT_MSG2, EV_RETRY
This cycle of completing PHASE 2 to the Qwest_Backup_IP and tearing it down keeps continuing until the Cox_Primary_IP is restored.
... View more
Created by
Jesse Shumaker
in VPN and AnyConnect
in VPN and AnyConnect
01-23-2018
10:40 AM
01-23-2018
10:40 AM
When the failover is active I have physically shutdown the port to the Cox_Primary Interface. so the routing tables looks like this with no entries to Cox_Primary. This is what has surprised me about the VPN tunnel flapping being attempted through the Cox_Primary Interface.:
Gateway of last resort is [qwest_gateway_per_ip] to network 0.0.0.0
S* 0.0.0.0 0.0.0.0 [254/0] via [qwest_gateway_per_ip], Qwest_Backup C [qwest_ip_subnet] 255.255.255.248 is directly connected, Qwest_Backup L [qwest_cer_ip] 255.255.255.255 is directly connected, Qwest_Backup C 169.254.1.0 255.255.255.252 is directly connected, nlp_int_tap L 169.254.1.1 255.255.255.255 is directly connected, nlp_int_tap C 192.168.1.0 255.255.255.0 is directly connected, LANInterface L 192.168.1.1 255.255.255.255 is directly connected, LANInterface
route Cox_Primary 0.0.0.0 0.0.0.0 [cox_gateway_per_ip] 1 track 1 route Qwest_Backup 0.0.0.0 0.0.0.0 [ qwest_gateway_per_ip ] 254
sla monitor 100 type echo protocol ipIcmpEcho 8.8.8.8 interface Cox_Primary num-packets 3 frequency 10 sla monitor schedule 100 life forever start-time now
... View more
Created by
Jesse Shumaker
in VPN and AnyConnect
in VPN and AnyConnect
01-22-2018
08:07 PM
01-22-2018
08:07 PM
I have a scenario where when the Primary ISP (the ISP with a tracked route fails) the backup ISP takes over and the remote L2L tunnels begin flapping between the primary ISP and the backup ISP. This only occurs on failover to the backup ISP. If I failback to the primary ISP the tunnel flapping stops.
crypto map VPN_Salas interface Qwest_Backup crypto map VPN_Salas interface Cox_Primary crypto isakmp identity address crypto ikev1 enable Qwest_Backup crypto ikev1 enable Cox_Primary <<<< If I remove this entry the Backup ISP tunnels establish and the flapping stops.
This must be code related, because we upgraded from a 5505 to a 5506 and started seeing these issues. I'm running 9.2. Whats confusing is I thought that when a route track goes down and the route is pulled from the routing table all associations to that Interface name are removed from service until restoration. So I don't know why the ASA thinks the "Cox_Primary" connection is still in services to initiate tunnel requests.
... View more
Labels:
11-05-2017
08:19 AM
I was suspecting a hardware issue. see output. What are we missing?
ASR1002-CORP-CLINK#sh platform hardware qfp active statistics drop
The active Embedded-Service-Processor is not inserted ASR1002-CORP-CLINK#sh platform hardware qfp active interface all The active Embedded-Service-Processor is not inserted ASR1002-CORP-CLINK#sh ip nat tra The active Embedded-Service-Processor is not inserted ASR1002-CORP-CLINK#sh platform Chassis type: ASR1002 Slot Type State Insert time (ago) --------- ------------------- --------------------- ----------------- 0 ASR1002-SIP10 ok 1d13h 0/0 4XGE-BUILT-IN ok 1d13h R0 ASR1002-RP1 ok, active 1d13h P0 ASR1002-PWR-AC ok 1d13h P1 ASR1002-PWR-AC ok 1d13h Slot CPLD Version Firmware Version --------- ------------------- --------------------------------------- 0 07120202 12.2(33r)XNC R0 08011017 12.2(33r)XNC ASR1002-CORP-CLINK#sh inv NAME: "Chassis", DESCR: "Cisco ASR1002 Chassis" PID: ASR1002 , VID: V05, SN: FOX1512G3ZC NAME: "Power Supply Module 0", DESCR: "Cisco ASR1002 AC Power Supply" PID: ASR1002-PWR-AC , VID: V02, SN: ART1519U0E7 NAME: "Power Supply Module 1", DESCR: "Cisco ASR1002 AC Power Supply" PID: ASR1002-PWR-AC , VID: V02, SN: ART1525U0X9 NAME: "module 0", DESCR: "Cisco ASR1002 SPA Interface Processor 10" PID: ASR1002-SIP10 , VID: V04, SN: JAE152001Y4 NAME: "SPA subslot 0/0", DESCR: "4-port Gigabit Ethernet Shared Port Adapter" PID: 4XGE-BUILT-IN , VID: V00, SN: N/A NAME: "subslot 0/0 transceiver 0", DESCR: "GE T" PID: N/A , VID: 2 , SN: AGM162123J4 NAME: "subslot 0/0 transceiver 1", DESCR: "GE T" PID: N/A , VID: 2 , SN: AGM162124U3 NAME: "module R0", DESCR: "Cisco ASR1002 Route Processor 1" PID: ASR1002-RP1 , VID: V04, SN: JAE1520086K
Here is the rear.
... View more
11-04-2017
08:32 AM
We recently purchased a refurbished ASR 1002-F running IOSXE
Cisco IOS Software, IOS-XE Software (PPC_LINUX_IOSD-IPBASEK9-M), Version 15.0(1)S3, RELEASE SOFTWARE (fc1)
which comes with the built-in route-processor but we are unable to successfully pass traffic of any kind, in or out of it. I brought the configuration down to the most basic element as shown below and pinged a connected laptop w/o success. NO ACL's, the laptop doesn't have a FW. ARP's won't even appear. ip routing is enabled on the ASR. Any help would be appreciated. My thought now is perhaps it's a license issue...?
Here's a ping to the laptop with debug ip packet turned on showing traffic is being generated but there's no receives
ASR1002-CORP-CLINK#ping 192.168.60.201
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.60.201, timeout is 2 seconds:
000260: *Nov 3 11:07:29.858 mst: IP: s=192.168.60.11 (local), d=192.168.60.201, len 100, local feature, feature skipped, NAT(2), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
000261: *Nov 3 11:07:29.858 mst: IP: tableid=0, s=192.168.60.11 (local), d=192.168.60.201 (GigabitEthernet0/0/1), routed via FIB
000262: *Nov 3 11:07:29.858 mst: IP: s=192.168.60.11 (local), d=192.168.60.201 (GigabitEthernet0/0/1), len 100, sending
000263: *Nov 3 11:07:29.859 mst: IP: s=192.168.60.11 (local), d=19.2.168.60.201 (GigabitEthernet0/0/1), len 100, output feature, feature skipped, Post-Ingress-NetFlow(57), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
000264: *Nov 3 11:07:31.870 mst: IP: s=192.168.60.11 (local), d=192.168.60.201, len 100, local feature, feature skipped, NAT(2), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
000265: *Nov 3 11:07:31.870 mst: IP: tableid=0, s=192.168.60.11 (local), d=192.168.60.201 (GigabitEthernet0/0/1), routed via FIB
000266: *Nov 3 11:07:31.870 mst: IP: s=192.168.60.11 (local), d=192.168.60.201 (GigabitEthernet0/0/1), len 100, sending
000267: *Nov 3 11:07:31.870 mst: IP: s=192.168.60.11 (local), d=19.2.168.60.201 (GigabitEthernet0/0/1), len 100, output feature, feature skipped, Post-Ingress-NetFlow(57), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
000268: *Nov 3 11:07:33.886 mst: IP: s=192.168.60.11 (local), d=192.168.60.201, len 100, local feature, feature skipped, NAT(2), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
000269: *Nov 3 11:07:33.886 mst: IP: tableid=0, s=192.168.60.11 (local), d=192.168.60.201 (GigabitEthernet0/0/1), routed via FIB
000270: *Nov 3 11:07:33.886 mst: IP: s=192.168.60.11 (local), d=192.168.60.201 (GigabitEthernet0/0/1), len 100, sending
000271: *Nov 3 11:07:33.886 mst: IP: s=192.168.60.11 (local), d=19.2.168.60.201 (GigabitEthernet0/0/1), len 100, output feature, feature skipped, Post-Ingress-NetFlow(57), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
000272: *Nov 3 11:07:34.203 mst: IP: s=65.118.94.162 (local), d=67.148.248.45, len 64, local feature, feature skipped, NAT(2), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
000273: *Nov 3 11:07:34.203 mst: IP: tableid=0, s=65.118.94.162 (local), d=67.148.248.45 (GigabitEthernet0/0/0), routed via FIB
000274: *Nov 3 11:07:34.203 m.
sh int gi 0/0/1
GigabitEthernet0/0/1 is up, line protocol is up Hardware is 4XGE-BUILT-IN, address is e8b7.48ff.c101 (bia e8b7.48ff.c101) Internet address is 192.168.60.11/24 MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive not supported Full Duplex, 1000Mbps, link type is auto, media type is T output flow-control is on, input flow-control is on ARP type: ARPA, ARP Timeout 04:00:00 Last input 3d00h, output 00:12:14, output hang never Last clearing of "show interface" counters 00:13:33 Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 1681 packets input, 106305 bytes, 0 no buffer Received 1629 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 52 multicast, 0 pause input 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 195193 pause output 0 output buffer failures, 0 output buffers swapped out
interface config
interface GigabitEthernet0/0/1
ip address 192.168.60.11 255.255.255.0
negotiation auto
... View more
Labels:
Created by
Jesse Shumaker
in Voice Systems
in Voice Systems
02-28-2014
07:12 PM
02-28-2014
07:12 PM
That tool you speak of might not exist. The formatting of the device occurs during the install. so after you setup the tftp sever with the configuration files from the guide I listed above what happens after this part? The Ethernet interface is internal. Enter cue-installer.2.0.1 for the default helper image. Ensure that the default boot is always disk, the default boot loader is always primary, and the Ethernet interface is always set to internal. ServicesEngine boot-loader>config IP Address [14.80.227.141] >14.80.227.141 Subnet mask [255.255.255.0] >255.255.255.0 TFTP server [14.80.227.128] >14.80.227.128 Gateway [14.80.227.140] >14.80.227.140 Default Helper-file [cue-installer.2.0.1] >cue-installer.2.0.1 Ethernet interface [internal] >internal Default Boot [disk] >disk Default bootloader [primary|secondary] [primary] >primary Updating flash with bootloader configuration The system writes the information onto the Flash, and the ServicesEngine boot loader> prompt appears again. Another Links you might find helpful http://packetlife.net/blog/2009/nov/2/generic-compact-flash-cards-and-cisco/ http://www.acumen-corp.com/Blog/tabid/298/entryid/28/UC500-UC520-UC540-UC560-Voicemail-CUE-non-functional-and-inaccessible-Service-Module-is-trying-to-recover-from-reset-shutdown-error-failed.aspx
... View more
Created by
Jesse Shumaker
in Voice Systems
in Voice Systems
02-28-2014
06:12 PM
02-28-2014
06:12 PM
Tom, Are you sure the CUE CF that came with the unit was broken? I ended up fixing mine after doing a boot helper fresh load. I had no backup so this was my only option to restore CUE. You sound like you are another step back, because the flash is brand new. I still was able to bootup IOS and the startup-config loaded. The flash didn't need to be replaced. Did you make sure the flash you got was cisco certified. there's only certain ones that work. I never had to go down that path. I did the boot helper load and this fixed my flash io block issues you see above. So if your old flash is gone try this to get it to a working state where the ios is bootable and your startup-config is also loading, than perform the CUE installation The ideal method to format the flash is by using the "format flash:" command from inside the UC500 Command Line Interface (CLI). In your case, since the UC500 won't even boot, your best option is to: 1) Format it using FAT in Windows, and move the IOS image plus the default configuration to the flash.You can get the latest 7.0.3 ZIP bundle from: https://supportforums.cisco.com/docs/DOC-9829 IOS is a ".bin" file and default config a ".cfg" that will depend on your UC500 model. They are easily identifiable. 2) Re-insert the flash in the UC500 and reboot. 3) Once you get the system up and running with the IOS image, do a "copy flash:UC500XXXX.cfg startup-config" via the console (use HyperTeminal 9600, 8, N, 1 username/password = cisco/cisco. Enter enable mode by typing "enable" before doing the copy command) 4) Reboot the UC500 one more time. 5) perform CUE boot helper installation http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unity-express/69303-cue-install-upgrade-guide.html#t9
... View more
Created by
Jesse Shumaker
in Firewalls
in Firewalls
10-14-2013
03:33 PM
10-14-2013
03:33 PM
ok so I removed the sqlnet stuff from the policy-map and the class-maps and put this in. how do I apply it though and is this right? here is config from that. where else do I apply this for it to work? class-map mssql match port tcp eq 1433
... View more
Created by
Jesse Shumaker
in Firewalls
in Firewalls
10-13-2013
09:47 PM
10-13-2013
09:47 PM
Here is the situation. I have the VPN anyconnect client connected and can access other resources like pinging the hosts, windows shares, rdp to this sql server. I just can't sql connect from an emr software (emds) into the 192.168.1.15 server running sql 2008. I have run a telnet 192.168.1.15 1433 and it looks like it works because it doesn't say timeout but sits there with a blinking cursor. What could I be doing wrong that makes this application throw these "could not connect to database" errors? All clients inside the remote lan connect fine to the sql server. all firewalls are disabled and this occurs on windows xp and windows 7. the sql server is running on the standard port 1433. here is latest config. !
ClovisASA5505# sh run
: Saved
:
ASA Version 9.1(2)
!
hostname ClovisASA5505
enable password Q5.xk4n2H9znnAYZ encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd 2KFQnbNIdI.2KYOU encrypted
names
ip local pool VPN_POOL 10.201.201.1-10.201.201.50 mask 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
description LAN
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
description ISP
mac-address 0026.5af9.689b
nameif outside
security-level 0
ip address 52.56.11.22 255.255.254.0
!
boot system disk0:/asa912-k8.bin
ftp mode passive
object network Local_Network
subnet 192.168.1.0 255.255.255.0
object network Internet
host 52.56.11.22
object network vMware_Server
host 192.168.1.10
object network vmWare_Port_4443_443
host 192.168.1.10
object network vmWare_Port_222_22
host 192.168.1.10
object network vmWare_Port_902_902
host 192.168.1.10
object network eMds_Server
host 192.168.1.15
object network eMds_Server_3389_3389
host 192.168.1.15
object network VPN_Hosts
subnet 10.201.201.0 255.255.255.0
access-list outside_access_in extended permit tcp any object vMware_Server eq 4443
access-list outside_access_in extended permit tcp any object vMware_Server eq 222
access-list outside_access_in extended permit tcp any object vMware_Server eq 902
access-list outside_access_in extended permit tcp any object Internet eq ssh
access-list outside_access_in extended permit tcp any object eMds_Server eq 3389
access-list outside_access_in extended permit tcp any object vMware_Server eq https
access-list outside_access_in extended permit tcp any object vMware_Server eq ssh
access-list ANYCONNECT_SPLIT_TUNNEL standard permit 192.168.1.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-713.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static Local_Network Local_Network destination static VPN_Hosts VPN_Hosts
!
object network Local_Network
nat (inside,outside) dynamic interface
object network vmWare_Port_4443_443
nat (inside,outside) static interface service tcp https 4443
object network vmWare_Port_222_22
nat (inside,outside) static interface service tcp ssh 222
object network vmWare_Port_902_902
nat (inside,outside) static interface service tcp 902 902
object network eMds_Server_3389_3389
nat (inside,outside) static interface service tcp 3389 3389
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 68.66.82.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa local authentication attempts max-fail 5
http server enable
http 192.168.1.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 192.168.1.0 255.255.255.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 10
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
enable outside
anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
anyconnect enable
tunnel-group-list enable
group-policy Clovis_AnyConnect_Profile internal
group-policy Clovis_AnyConnect_Profile attributes
dns-server value 192.168.1.11
vpn-tunnel-protocol l2tp-ipsec ssl-client ssl-clientless
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ANYCONNECT_SPLIT_TUNNEL
address-pools value VPN_POOL
username cisco password KIklOnzBzo2pJ/xJ encrypted privilege 15
username clovis password VXlcBBiSE.stdpId encrypted
username clovis attributes
service-type remote-access
tunnel-group Clovis_VPN type remote-access
tunnel-group Clovis_VPN general-attributes
default-group-policy Clovis_AnyConnect_Profile
tunnel-group Clovis_VPN webvpn-attributes
group-alias ClovisVPN enable
!
class-map sqlnet
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:61af2857ff8bfb397172c9137c92e1eb
: end
ClovisASA5505#
... View more
Labels:
Created by
Jesse Shumaker
in Routing
03-29-2019
03-29-2019
I got a response from the ISP. Looks like there was no issue here. I'll
close the discussion. thanks...
Created by
Jesse Shumaker
in Routing
03-28-2019
03-28-2019
the only logs I have from the ISP are those 06h36m21s timestamps on the
route age I posted in the fi...
Created by
Jesse Shumaker
in Routing
03-26-2019
03-26-2019
One of my ISP's reached out to me the other day to notify me that I had
unadvertised both of my /24 ...
Created by
Jesse Shumaker
in VPN and AnyConnect
01-29-2018
01-29-2018
ok should this be at all sites including this problem site or just the
problem site? isakmp keepaliv...
Created by
Jesse Shumaker
in VPN and AnyConnect
01-25-2018
01-25-2018
The other tunnels do clear out. I continuously run this command and see
them all clear and begin est...
Created by
Jesse Shumaker
in VPN and AnyConnect
01-23-2018
01-23-2018
very similar to this flapping site crypto ipsec ikev1 transform-set
ESP-3DES-SHA esp-3des esp-sha-hm...
Created by
Jesse Shumaker
in VPN and AnyConnect
01-23-2018
01-23-2018
Here is one of the other sites. There are 5 other sites which have L2L
tunnels to this flapping site...
Created by
Jesse Shumaker
in VPN and AnyConnect
01-23-2018
01-23-2018
When the failover is active I have physically shutdown the port to the
Cox_Primary Interface. so the...
Created by
Jesse Shumaker
in VPN and AnyConnect
01-22-2018
01-22-2018
I have a scenario where when the Primary ISP (the ISP with a tracked
route fails) the backup ISP tak...
11-05-2017
I was suspecting a hardware issue. see output. What are we missing?
ASR1002-CORP-CLINK#sh platform h...
11-04-2017
We recently purchased a refurbished ASR 1002-F running IOSXE Cisco IOS
Software, IOS-XE Software (PP...
02-28-2014
That tool you speak of might not exist. The formatting of the device
occurs during the install. so a...
02-28-2014
Tom,Are you sure the CUE CF that came with the unit was broken? I ended
up fixing mine after doing a...
Created by
Jesse Shumaker
in TelePresence and Video Infrastructure
01-28-2014
01-28-2014
I think what I'm looking for is the guide or white paper or howto on how
QoS is applied, so I unders...
Created by
Jesse Shumaker
in TelePresence and Video Infrastructure
01-27-2014
01-27-2014
I'm wondeiring if anyone can point me into the right direction for a
guide on how QoS should be appl...
Public Statistics
| Date Registered | 10-31-2010 12:50 PM |
| Date Last Visited | 04-05-2019 10:34 AM |
| Total Messages Posted | 152 |
