Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About FlorianCokl
06-12-2018
Stats
Member since
04-21-2005
50
Posts
29
Helpful
0
Solutions
06-12-2018
08:23 AM
Fantastic! And it works with OSX as well. Just removed the ~/.asdm folder - done.
... View more
04-11-2018
01:05 PM
Hi Hemant Kumar,
I've tried it with a simulation and used a sniffer to verify.
Enable preemption and set priorities like
R1 priority 104
R2 priority 103
R3 priority 102
R4 priority 101
R5 default 100
If you don't assign priority then the highest IP for the segment wins the AVG election. In this case R1 wins AVG election. However, enable preemption to have it deterministic instead of who comes online first, dies first, last .......
When it comes to AVF - it follows these same priorities i.e.
R1 will become active forwarder 1 (the first virtual MAC-address) - also the AVG
R2 will become active forwarder 2 (the second virtual MAC-address)
R3 will become active forwarder 3 (the third virtual MAC-address)
R4 will become active forwarder 4 (the fourth virtual MAC-address)
The sniffer told me that the AVG priorities are exactly as I've set them via CLI - AVF priority in the hello from R1 through R4 is 167 - except for R5 since is listening only for all 4 virtual forwarder addresses - wherever that comes from? I haven't found a way to change the AVF priority.
Although there is a command glbp 1 forwarder preempt which supposingly enables preemption i.e. overthrow the current forwarder, I hadn't configured it - yet - the forwarder gets overthrown anyway after 30 seconds?
Kind Regards
... View more
Created by
FlorianCokl
in Networking Documents
in Networking Documents
01-29-2018
12:54 AM
01-29-2018
12:54 AM
Taken from Jeff Doyle's TCP/IP, Volume 1, 2/e (my preferred source)
Chapter 2 IPv6 Overview
Address Autoconfiguration
When an IPv6 host first becomes active on a link, it can self-configure its own interface address. The first step in this process is the determination of the 64-bit Interface ID portion of the address. On broadcast interfaces (where hosts are most likely to appear), a mechanism called MAC-to-EUI64 conversion is used. Quite simply, this mechanism takes the 48-bit Media Access Control (MAC) address of the interface - which can normally be assumed to be globally unique - and converts it into a 64-bit Interface ID by inserting a reserved 16-bit value of 0xFFFE into the middle of the MAC address and "flipping" the Universal/Local (U/L) bit of the MAC address to 1.
Taking that info and combining it with MAC-addresses in general, the OUI specifically:
the 7th bit is the U/L - Universal (globally unique, OUI-enforced) i.e. "0", Locally (locally administered i.e. self-assigned) i.e. "1.
So it makes perfect sense. What about VMs, virtual hosts? To me it looks like they have no other choice but to use a self-assigned MAC i.e. flipping the 7th to 1, to begin with. So - if the bit is already flipped there's no need to flip it again. It was locally administered and running the MAC-to-EUI64 conversion doesn't change anything - to me, at least.
... View more
06-27-2017
03:30 AM
Here's one I've created with GIMP only recently - for Nexus 7k.
With this png you can create your own stencil from within MS Visio.
Hope it fits your expectations?
Cheers
Florian
... View more
10-08-2016
11:57 AM
Hi Mohanish
still an existing issue? Where you able to resolve it?
Hint: NAT - many forget to include a NAT-exempt-rule (former no-NAT-rule) i.e. traffic from your inside LAN(s) to the Remote-Access-VPN-LAN(s) must not be NATed.
Make sure this NAT-exempt-rule is at the very top of all your NAT-rules -> hint: acl-like behavior.
... View more
05-12-2016
06:53 AM
Hello Guys
I wanted to use this forum to collect experience from others about using the boot config command i.e. setting a boot variable to load from a different config file.
Here is what I've found out:
Usually the startup-config is NOT visible on the ASA. Once you set the boot variable (either through CLI or ASDM) the startup-config becomes "just visible" in flash.
I recently had a situation - needed to change IP-Adresses and routing on the outside interface of an ASA without having access to the console - just SSH and or ASDM. Here is what I've found out - what I did.
Copied some text-file to the flash
Saved the running-config
Changed the boot-variable to the name of "some text-file"
Saved the running-config
Now - the "some text-file" in flash would be overwritten with the actual running-config of the ASA - ok.
Try this at home, in the lab, with an ASA you have access to via console-cable! Lets do the following:
Download the now filled with running-config "some text-file" to your local PC
Make the changes you wanted in that text-file
Upload the changed "some text-file" back to ASA i.e. overwrite the existing one in flash
Reload the Device
Watch carefully the CLI!
What your going to see - well - forget what you see through the boot process. The more interesting part is: will my changes come into play i.e. will I see them now in the running-config?! No I won't! Why? There's this little innocent line at the end of your startup-config "..crypto checksum.." - which I believe is the "culprit".
What could you do instead? Well - create a text-file with exactly the commands you need, to change, what you want to be changed. In my case change interface configuration of the outside and routing (no route.. and route ....)
Upload this file to flash
Connect via CLI
Copy the text-file to running-config (copy <name of file> running-config)
Hope that you hadn't made a mistake ;-)
I thought that the running-config would be overwritten - hm - it's merging, to be true. The ASA would only alter the parts of running-configuration that I had mentioned in the file I had uploaded to flash and copied to running-config. Save your config ;-)
Has anybody an idea how you would be able to use the boot config boot-variable to actually force the ASA at next reload to come up with a lets say totally different configuration?! Lets say we change the working mode of the ASA from routed to transparent! Hint: crypto checksum of the config-file?!
Looking forward to your answers.
Cheers
... View more
Labels:
05-12-2016
06:36 AM
Hey JimmyC :)
Actually - not odd. Usually the startup-config is NOT visible on the ASA. Once you set the boot variable (either through CLI or ASDM) the startup-config becomes "just visible" in flash.
I recently had a similar situation - needed to change IP-Adresses and routing on the outside interface of an ASA without having access to the console - just SSH and or ASDM. Here is what I've found out - what I did.
Copied some text-file to the flash
Saved the running-config
Changed the boot-variable to the name of "some text-file"
Saved the running-config
Now - the "some text-file" in flash would be overwritten with the actual running-config of the ASA - ok.
Try this at home with an ASA you have access to via console-cable! Lets do the following:
Download the altered "some text-file" to your local PC
Make the changes you wanted in that text-file
Upload the changed "some text-file" back to ASA i.e. overwrite the existing one in flash
Reload the Device
Watch carefully the CLI!
What your going to see - well - forget what you see through the boot process. The more interesting part is: will my changes come into play i.e. will I see them now in the running-config?! No I won't! Why? There's this little innocent line at the end of your startup-config "..crypto checksum.."
What could you do instead? Well - create a text-file with exactly the commands you need, to change, what you want to be changed. In my case change interface configuration of the outside and routing (no route.. and route ....)
Upload this file to flash
Connect via CLI
Copy the text-file to running-config (copy <name of file> running-config)
Hope that you hadn't made a mistake ;-)
I thought that the running-config would be overwritten - hm - it's merging, to be true. The ASA would only alter the parts of running-configuration that I had mentioned in the file I had uploaded to flash and copied to running-config.
That's how I did it - hope it helps clear out the skys?
... View more
02-08-2016
02:17 PM
I am not interested in complaining, nagging around - I do understand everyone who is missing the switching functionality - personally, I couldn't agree more that the missing switching functionality is a pain bla bla bla.
However, I am interested in solutions. I like to be part of a solution instead of participating in the problem.
Here's a solution that works - as long as you are willing to think into it. Get 1 cheapest unmanaged 4-port-GigabitSwitch -> you need it to connect the management-port with 1 from the other L3 ports and a host. Assuming you have 1 interface (Number 1) connected to the internet you have 7 (2-8) left to connect 7 hosts. If you need 2 interfaces (1 & 2) for WAN (backup-lines or any other name you prefer) there are 6 (3-8) left to connect 6 hosts.
Next
SubSubSubSubnetting
take the 192.168.1.0/24 network (why this one/way -> summarization) - or any other number that is your personal favorite and break it down into segments of 32 each, or any other number you like as long as you are able to derive at least 7 consecutive networks:
192.168.1.0/27 255.255.255.224
192.168.1.32/27 255.255.255.224
192.168.1.64/27 255.255.255.224
192.168.1.96/27 255.255.255.224
192.168.1.128/27 255.255.255.224
192.168.1.160/27 255.255.255.224
192.168.1.192/27 255.255.255.224
192.168.1.224/27 255.255.255.224
and apply them to the physical interfaces - give each interface a distinctive name i.e. inside-1/3, inside-1/4 and so forth.
OR - major numbers
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24
and so forth
and apply them to the physical interfaces - give each interface a distinctive name i.e. inside-1/3, inside-1/4 and so forth.
Next
connect ASA's mgmt-intf, gi1/8 (or any other you like), and the one host, to the cheap switch. Make sure to configure the firepower-address according to the network you've chosen for that physical interface.
Resumé
I know this is not "beautiful" - I KNOW IT - however, if you are in tight spot, this is a way to get out of it. IT WORKS - keep that in mind.
... View more
Created by
FlorianCokl
in Collaboration, Voice and Video Documents
in Collaboration, Voice and Video Documents
10-21-2015
06:08 AM
10-21-2015
06:08 AM
Hi Luis, http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/10_0_1/ccmfeat/CUCM_BK_F3AC1C0F_00_cucm-features-services-guide-100/CUCM_BK_F3AC1C0F_00_cucm-features-services-guide-100_chapter_011000.html the document behind the link says that EM is supported with SIP, too. However, becareful for which phone you would like to enable EM since not all phones offer the capability to run this service - reverse logic to the "notes" in the document
... View more
10-14-2015
07:01 AM
Hi Douglas, do you still need help with ASA, NAT, ACL, reachability from outside? cheers
... View more
10-14-2015
06:59 AM
Hi, I would recommend the following: create objects for servers and public WAN-addresses at Configuration->Firewall->Objects->NetworkObjects/Group then utilize the Public Servers menu from ASDM at Configuration->Firewall->PublicServers Do you need further assistance -> email me Cheers Please, rate helpful answers
... View more
10-14-2015
06:43 AM
Hi Joseph, I had implemented ASCOM IPBL with CUCM in 2011 and I couldn't agree more to your complaints. I've only recently had the pleasure to see it again - 4 years later and nothing has changed, even with the latest Versions of CUCM and ASCOM. I would rather recommend WLAN with a sufficient density of WLAN-Accesspoints, and of course with a controller, not necessarily with 3850s since the volume of traffic phones will generate is something you can totally forget about it, and let the CAPWAP-tunnel terminate at the controller. Besides - with WLAN you could use Cisco-IP-telephony-Apps on all kinds of smart-phones as an additional solution/fallback etc. If you need help with this solution you can get in touch with me anyway. cheers
... View more
05-09-2015
05:55 AM
I had the same problem that a trustpoint ended up being Not authenticated if done through the ASDM. So I decided to do it through CLI. Create the trustpoint with enrollment through terminal. Enroll through terminal and copy the csr-output in a text-file. With the CSR-text-file get the certificate from your CA - make sure it's pem-formated. Authenticate the trustpoint through terminal. Kind Regards
... View more
Created by
FlorianCokl
in Firewalls
06-12-2018
06-12-2018
Fantastic! And it works with OSX as well. Just removed the ~/.asdm
folder - done.
04-11-2018
Hi Hemant Kumar, I've tried it with a simulation and used a sniffer to
verify. Enable preemption and...
01-29-2018
Taken from Jeff Doyle's TCP/IP, Volume 1, 2/e (my preferred source)
Chapter 2 IPv6 Overview Address ...
06-27-2017
Here's one I've created with GIMP only recently - for Nexus 7k. With
this png you can create your ow...
10-08-2016
Hi Mohanish still an existing issue? Where you able to resolve it? Hint:
NAT - many forget to includ...
05-12-2016
Hello Guys I wanted to use this forum to collect experience from others
about using the boot config ...
05-12-2016
Hey JimmyC :) Actually - not odd. Usually the startup-config is NOT
visible on the ASA. Once you set...
02-08-2016
I am not interested in complaining, nagging around - I do understand
everyone who is missing the swi...
Created by
FlorianCokl
in Collaboration, Voice and Video Documents
10-21-2015
10-21-2015
Hi Luis,
http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/10_0_1/ccmfeat/CUCM_BK_F3AC1C...
10-14-2015
Hi,I would recommend the following:create objects for servers and public
WAN-addresses at
Configurat...
10-14-2015
Hi Joseph,I had implemented ASCOM IPBL with CUCM in 2011 and I couldn't
agree more to your complaint...
Public Statistics
| Date Registered | 04-21-2005 12:44 PM |
| Date Last Visited | 06-12-2018 05:59 PM |
| Total Messages Posted | 50 |
| Total Helpful Votes Received | 29 |
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 5 |
