About srue

srue · ‎09-18-2017

Most of us know that you need "promiscuous" mode allowed/accepted on the vSwitches/port groups, but I found out that I also need (using a 4451-x w/ UCSE 180 double wide) to allow "forged transmits". Thanks

srue · ‎09-07-2017

I appreciate the feedback. We currently use FlexConnect for our corporate WLANs, but our guest WLAN (including guest *wired) gets tunneled back to an anchor controller to a dedicated set of firewalls for guests. I don't think that solution works - not without setting up some PBR, vRF's, etc...

srue · ‎09-07-2017

I've stood up an eval version of a vWLC 8.2.161 on a UCS E-series blade. I'm trying to test/proof of concept vWLC with a guest wired configuration. This works fine on our physical 5508's, but when I go to create an interface or a WLAN on the virtual WLC, there is no option for GUEST LAN. Is this by design or am I missing something? I've looked at the features *not supported* in virtual WLC's, and I don't see this listed explicitly: Cisco Aironet 1850 and 1830 Series APs Internal DHCP server TrustSec SXP Access points in local mode Mobility/Guest Anchor Multicast High Availability PMIPv6 EoGRE (Supported in only local switching mode) Workgroup Bridges Client downstream rate limiting for central switching SHA2 certificates Cisco OfficeExtend Access Points I do see "Mobility/Guest Anchor", but that's not technically what I'm trying to do here. Thanks in advance

srue · ‎05-31-2016

Add 9.4.2(11) to the affected releases.

srue · ‎12-10-2015

Looks like it's not supported in IP Base...that's my problem. Thanks...

srue · ‎12-10-2015

I can't find anything stating that this isn't supported, but I'm unable to enable BFD on my tenG interfaces, which are online and routing. Does anyone know if this is supported? The error I receive: ASR1002X-02(config-router)#bfd interface ten0/2/0 %EIGRP: TenGigabitEthernet0/2/0 is not supported by BFD Cisco IOS XE Software, Version 03.16.01a.S - Extended Support Release Cisco IOS Software, ASR1000 Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.5(3)S1a, RELEASE SOFTWARE (fc1) License Level: ipbase XFP is SPA-1X10GE-L-V2 -TIA- (I realize the error says it's not supported, but all of the documentation I can find says this should be supported)

srue · ‎08-26-2015

Thanks for the response... But what about VLANs on the backside that aren't to be extended (I only want to extend a subset of the VLANs on the LAN side)? I know I don't need another 'join interface', but do I need another LAN side connection for non-extended VLANs? Thanks

srue · ‎07-24-2015

I've looked over too many design/config guides to count at this point, and my scenario/question is this...There are two data centers connected through a single 10G link, with ASR's on both ends, and some L3 switch behind the ASR on either end. I have only a few VLANs (of many) that need to be extended through OTV. In this scenario, does the ASR need to be dual homed to the LAN side on each end - a connection for L2/OTV to the inside, and a L3 to the inside LAN for non-extended VLANs (so 3 connections from the ASR total, if you count the WAN side)? Every design/config guide I've gone through seems to only address it as if all VLANs were being extended. Thanks in advance...

srue · ‎02-11-2014

I found this: On ACS 5.x Default Device Admin = Tacacs+ Default Network Access = Radius here: https://supportforums.cisco.com/thread/2036274 Is this still the case for 5.5? Does that mean Tacacs can't be used for NetworkAccess regardless?

srue · ‎02-11-2014

As the subject says, I'm trying to see if there's a way to use TACACs for both device admin and VPN authentication on an ASA to the same ACS 5.5 server. I know I could split up the protocols between RADIUS (VPN) and TACACS (device admin), I just need to know first if using tacacs for both is even possible. TIA

srue · ‎02-27-2013

I'm attempting to set up (for testing purposes) a 2nd 'guest' SSID on an internal WLC (WLC-A), and terminate it in a DMZ on an anchor controller (WLC-B). We already have a guest SSID originating on WLC-A and terminating on WLC-B though. Is it possible to originate a 2nd guest SSID on WLC-A? WLC-A - 2504 (7.2.x) WLC-B - 5508 (7.2.x) The problem I'm seeing is I'm getting no DHCP address assigned on the test SSID. If I statically assign IP information I still have no connectivity. It's as if the EoIP tunnel for the 2nd test SSID isn't functional. TIA

srue · ‎01-29-2013

Did anyone try Portu's response? tunnel-group AnyConnect general-attributes authentication-server-group RADIUS ! tunnel-group AnyConnect webvpn-attributes authentication aaa certificate I'm trying to do the same thing except using ISE as the radius servers. Thanks.

srue · ‎02-01-2012

software version 7.0.116.0 (4402's).

srue · ‎02-01-2012

Can I use the same cert for 3 different controllers for this purpose? Each has the same virtual interface IP - 1.1.1.1. If I just assign each the same DNS hostname under the virtual interface, and then put that entry in our internal DNS resolving back to 1.1.1.1, can I put the same cert on each appliance? TIA

srue · ‎01-25-2012

I will modify the route-map and eliminate the match statement sometime in the near future. (next day or two) I've been monitoring CPU usage using Cacti, along with the show proc cpu sorted command - which shows high IP INPUT cpu usage. I've read conflicting information about using the 'set ip default next-hop' command. Some sources say that command always causes packets to be software switched, other sources don't say that. Some of my route-maps use 'set ip next-hop' which may be where the actual cpu decreased..not sure though.

Date Registered	‎01-05-2006 07:46 PM
Date Last Visited	‎09-18-2018 09:55 AM
Total Messages Posted	1,867
Total Helpful Votes Received	538

Re: Firepower Threat Defense for ISR 4K...

Re: vWLC and guest LAN feature

vWLC and guest LAN feature

Add 9.4.2(11) to the affected

Looks like it's not supported

Cisco ASR1002x - 10Gig interfaces, BFD ...

Thanks for the response...But

ASR OTV Design question - not extending...

ACS 5.5 - ASA tacacs auth for both devi...

ACS 5.5 - ASA tacacs auth for both devi...

Originating more than 1 EoIP tunnel to ...

[Cisco AnyConnect] Certificate authenti...

Certificate question for WLC acceptance...

Certificate question for WLC acceptance...

Alternatives to PBR on 7606 (sup720's)?...