Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About srue
12-28-2018
srue
Rising star
I've been doing Cisco networking since 1999, focusing on general networking and security. These days I'm the network administrator for a public health department, hospital, and its associated clinics.
Recent Badges
Stats
Member since
01-05-2006
1868
Posts
528
Helpful
115
Solutions
Created by
srue
in Security Documents
in Security Documents
09-18-2017
10:57 AM
09-18-2017
10:57 AM
Most of us know that you need "promiscuous" mode allowed/accepted on the vSwitches/port groups, but I found out that I also need (using a 4451-x w/ UCSE 180 double wide) to allow "forged transmits". Thanks
... View more
09-07-2017
12:38 PM
I appreciate the feedback. We currently use FlexConnect for our corporate WLANs, but our guest WLAN (including guest *wired) gets tunneled back to an anchor controller to a dedicated set of firewalls for guests. I don't think that solution works - not without setting up some PBR, vRF's, etc...
... View more
09-07-2017
11:44 AM
I've stood up an eval version of a vWLC 8.2.161 on a UCS E-series blade. I'm trying to test/proof of concept vWLC with a guest wired configuration. This works fine on our physical 5508's, but when I go to create an interface or a WLAN on the virtual WLC, there is no option for GUEST LAN. Is this by design or am I missing something? I've looked at the features *not supported* in virtual WLC's, and I don't see this listed explicitly: Cisco Aironet 1850 and 1830 Series APs Internal DHCP server TrustSec SXP Access points in local mode Mobility/Guest Anchor Multicast High Availability PMIPv6 EoGRE (Supported in only local switching mode) Workgroup Bridges Client downstream rate limiting for central switching SHA2 certificates Cisco OfficeExtend Access Points I do see "Mobility/Guest Anchor", but that's not technically what I'm trying to do here. Thanks in advance
... View more
Labels:
12-10-2015
04:03 PM
Looks like it's not supported in IP Base...that's my problem.
Thanks...
... View more
12-10-2015
01:15 PM
I can't find anything stating that this isn't supported, but I'm unable to enable BFD on my tenG interfaces, which are online and routing. Does anyone know if this is supported?
The error I receive:
ASR1002X-02(config-router)#bfd interface ten0/2/0 %EIGRP: TenGigabitEthernet0/2/0 is not supported by BFD
Cisco IOS XE Software, Version 03.16.01a.S - Extended Support Release Cisco IOS Software, ASR1000 Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.5(3)S1a, RELEASE SOFTWARE (fc1)
License Level: ipbase
XFP is SPA-1X10GE-L-V2
-TIA-
(I realize the error says it's not supported, but all of the documentation I can find says this should be supported)
... View more
Labels:
08-26-2015
05:00 AM
Thanks for the response... But what about VLANs on the backside that aren't to be extended (I only want to extend a subset of the VLANs on the LAN side)? I know I don't need another 'join interface', but do I need another LAN side connection for non-extended VLANs? Thanks
... View more
Created by
srue
in Other Data Center Subjects
in Other Data Center Subjects
07-24-2015
10:10 AM
07-24-2015
10:10 AM
I've looked over too many design/config guides to count at this point, and my scenario/question is this...There are two data centers connected through a single 10G link, with ASR's on both ends, and some L3 switch behind the ASR on either end. I have only a few VLANs (of many) that need to be extended through OTV. In this scenario, does the ASR need to be dual homed to the LAN side on each end - a connection for L2/OTV to the inside, and a L3 to the inside LAN for non-extended VLANs (so 3 connections from the ASR total, if you count the WAN side)? Every design/config guide I've gone through seems to only address it as if all VLANs were being extended. Thanks in advance...
... View more
- Tags:
- OTV ASR
Labels:
Created by
srue
in Policy and Access
in Policy and Access
02-11-2014
01:34 PM
02-11-2014
01:34 PM
I found this: On ACS 5.x Default Device Admin = Tacacs+ Default Network Access = Radius here: https://supportforums.cisco.com/thread/2036274 Is this still the case for 5.5? Does that mean Tacacs can't be used for NetworkAccess regardless?
... View more
Created by
srue
in Policy and Access
in Policy and Access
02-11-2014
01:20 PM
02-11-2014
01:20 PM
As the subject says, I'm trying to see if there's a way to use TACACs for both device admin and VPN authentication on an ASA to the same ACS 5.5 server. I know I could split up the protocols between RADIUS (VPN) and TACACS (device admin), I just need to know first if using tacacs for both is even possible. TIA
... View more
Labels:
Created by
srue
in VPN and AnyConnect
in VPN and AnyConnect
01-29-2013
06:55 AM
01-29-2013
06:55 AM
Did anyone try Portu's response? tunnel-group AnyConnect general-attributes authentication-server-group RADIUS ! tunnel-group AnyConnect webvpn-attributes authentication aaa certificate I'm trying to do the same thing except using ISE as the radius servers. Thanks.
... View more
Created by
srue
in Wireless and Mobility
in Wireless and Mobility
02-01-2012
05:29 AM
02-01-2012
05:29 AM
software version 7.0.116.0 (4402's).
... View more
Created by
srue
in Wireless and Mobility
in Wireless and Mobility
02-01-2012
05:28 AM
02-01-2012
05:28 AM
Can I use the same cert for 3 different controllers for this purpose? Each has the same virtual interface IP - 1.1.1.1. If I just assign each the same DNS hostname under the virtual interface, and then put that entry in our internal DNS resolving back to 1.1.1.1, can I put the same cert on each appliance? TIA
... View more
Labels:
01-25-2012
12:59 PM
I will modify the route-map and eliminate the match statement sometime in the near future. (next day or two) I've been monitoring CPU usage using Cacti, along with the show proc cpu sorted command - which shows high IP INPUT cpu usage. I've read conflicting information about using the 'set ip default next-hop' command. Some sources say that command always causes packets to be software switched, other sources don't say that. Some of my route-maps use 'set ip next-hop' which may be where the actual cpu decreased..not sure though.
... View more
Created by
srue
in Security Documents
09-18-2017
09-18-2017
Most of us know that you need "promiscuous" mode allowed/accepted on the
vSwitches/port groups, but ...
09-07-2017
I appreciate the feedback. We currently use FlexConnect for our
corporate WLANs, but our guest WLAN ...
09-07-2017
I've stood up an eval version of a vWLC 8.2.161 on a UCS E-series blade.
I'm trying to test/proof of...
04-10-2017
I'm getting the same error on my 8350 appliance FAILED
200_pre/006_check_snort.sh I'm trying to upgr...
12-10-2015
I can't find anything stating that this isn't supported, but I'm unable
to enable BFD on my tenG int...
08-26-2015
Thanks for the response...But what about VLANs on the backside that
aren't to be extended (I only wa...
Created by
srue
in Other Data Center Subjects
07-24-2015
07-24-2015
I've looked over too many design/config guides to count at this point,
and my scenario/question is t...
Created by
srue
in Policy and Access
02-11-2014
02-11-2014
I found this:On ACS 5.xDefault Device Admin = Tacacs+Default Network
Access = Radiushere: https://su...
Created by
srue
in Policy and Access
02-11-2014
02-11-2014
As the subject says, I'm trying to see if there's a way to use TACACs
for both device admin and VPN ...
Created by
srue
in VPN and AnyConnect
01-29-2013
01-29-2013
Did anyone try Portu's response? tunnel-group AnyConnect
general-attributes authentication-server-gr...
Created by
srue
in Wireless and Mobility
02-01-2012
02-01-2012
Can I use the same cert for 3 different controllers for this purpose?
Each has the same virtual inte...
Public Statistics
| Date Registered | 01-05-2006 07:46 PM |
| Date Last Visited | 12-28-2018 07:27 AM |
| Total Messages Posted | 1,868 |
| Total Helpful Votes Received | 528 |
Helpful Votes Given To
.jpg "Hall of Fame Master"){kind=icon}
Helpful Votes From
