Hello All,   Historically when I've asked my reseller for WLC adder licenses they have quoted me the line items L-LIC-CT2504-5A & L-LIC-CT2504-UPG (zero value).  Now they are saying I have to purchase a compulsory contract item number  CON-ECMU-LCT255A.  Is this correct or are they forcing an up-sell on me?  Note the system is in a residential environment and the client is not wanting contracts etc..   Thoughts anyone? Regards ... View more

Hello All,   I'm looking for a bit of guidance or options to deal with a change I need to implement.  I currently have 2 x cisco 867vae routers each with a VDSL connected to a network with 2 VRRP instances running so that various vlans can have their internet traffic directed out each of the VDSL services but if one fails they failover.  All works ok however on the "corporate" vlan the client wants an ASA5506 to replace one of the 867VAE routers as the circuit is to be upgraded to a Fiber To The Premises .  So I have a failover issue to solve as well as traffic balancing.     Connecting to the ASA and 867VAE is an SG300 Switch.  I was thinking to switch on EIGRP on switch, ASA and 867VAE to deal with my VRRP no longer being an option. I could potentially use multiple EIGRP instances to direct traffic for specific vlans to specific routers. I know I could do all the failover on the ASA and direct traffic to the 867VAE router on loss of the Fiber, but this doesn't provide any protection if the ASA falls over.     Has anyone got any other ideas on how to approach?    Thanks in advance Dave ... View more

Hello All,   Just looking for some feedback on the following requirement.  We have an IPTV solution going in spread over a few floors.  The Specification says the following with my comments in Blue and red.  Red being where I'm unsure.   The specification says Certified Switches are 2960's but am I wrong I can do it with SG550x's?  Any thoughts or comments would be appreciated.   IPTV Spec requirements - VLAN support - SG550x supports -Trunked ports (Ports that allow multiple VLAN tagged traffic as well as untagged traffic using PVID) - SG550x supports Multicast traffic features: - IGMP v2 support (IGMP v3 support also desirable) - SG550x supports - IGMP snooping support per VLAN - SG550x supports - Fast Leave - SG550x supports - Immediate Leave - Multicast traffic filtering - SG550x supports - Rules to allow/block multicast traffic per port based on source port or multicast id - ??? The SG550X has ACLs that can provide source port based allow/block but I cant see where I could specify Multicast ID in ACL's or other location.  I dont think the SG550x can do this. - Switch must be able to act as querier per VLAN. - SG550x supports - QoS classification based on VLAN if multiple services are run on the switches (ability to assign a priority to multicast traffic also desirable)  -  ??? I cant see this as an option.  I can only see options to apply Qos to physical interfaces or ACL's and there is not an option to apply to a Vlan.  I think the issue here is if multiple separate instances of IPTV use the same QOS settings you would have to have a Qos mappings per vlan.   -SNMP for monitoring - SG550x supports -Support for Microsoft multicast load balancing - This is at the Core and we have a 4500 Chassis so am ok with this.   I'd appreciate any feedback and thoughts. Regards Dave   ... View more

Hello All,   I have a new project which requires a guest environment as well as SSIDs for internal service. The client wants to utilise a 3rd party onboarding cloud based platform for the guests to be able to capture facebook etc.. however wants to retain the internal authentication for the internal services.  We are proposing a Cisco Wireless Controller solution.   The cloud based onboarding platform is radius based and I know I can set the SSID AAA to point towards various Radius Servers or no Radius as the case may be. Is this the best approach? Does anyone have any pointers on a likely scenario?   We are in the design phase at the moment so looking for ideas on how to provide a Guest Wifi with minimal administration but also obtaining user basic details.   Best Regards David   ... View more

Content Removed ... View more

Hello All,   Can anyone assist with the 1810 OEAP Access points and Mobility express?  I have 2 x 1832's setup as controllers and 2 additional 1832s connected as Lwapp's.  They work fine.  I have 4 x 1810  OEAP 's and they associate to the controller and I can see they have Ip addresses through the Controller GUI but they are not fully associated and keep re-attempting to associate.   I've tried mobility firmwares 8.4.100.0 and 8.5.103.0 but same issue although 8.5.103.0 i could see the  Below is the error messages on the 1810  OEAP 's.  I know something isnt correct as when I login to the Access Point from the console the username and pass are default and not inherited the credentials from the Mobiity platform   1810 IP addresses through the gui - See attached image.   Access Point Console log below WAP7#deb capwap client error WAP7#[*09/16/2017 16:32:03.4470] Calling wtpGetAcToJoin from timer expiry. [*09/16/2017 16:32:03.4470] DiscRep[0]: addr 192.168.1.51, apMgrCount 1 [*09/16/2017 16:32:03.4470] Selected MWAR 'FulmerME' 192.168.1.51 (index 0). [*09/16/2017 16:32:03.4470] apMgrCount 1, index 0 [*09/16/2017 16:32:03.4470] Adding Ipv4 AP manager 192.168.1.51 to least load [*09/16/2017 16:32:03.4470] WLC: FulmerME ApMgr count 1, ipTransportTried 0, prefer-mode 0, isIpv4OrIpv6Static 0 [*09/16/2017 16:32:03.4470] IPv4 Pref mode. Choosing AP Mgr with index 0, IP 192.168.1.51, load 5, AP ip: (192.168.1.111) [*09/16/2017 16:32:03.4470] capwapSetTransportAddr returning: index 0, apMgrCount 0 [*09/16/2017 16:32:03.4470] [*09/16/2017 16:32:03.4470] Synchronizing time with AC time: 1505579514 [*09/16/2017 16:31:54.0000] can't find the Ip from discoveryRequest array [*09/16/2017 16:31:54.0000] [*09/16/2017 16:31:54.0000] [*09/16/2017 16:31:54.0000] CAPWAP State: DTLS Setup [*09/16/2017 16:31:54.0000] DTLS connection created sucessfully local_ip: 192.168.1.111 local_port: 5248 peer_ip: 192.168.1.51 peer_port: 5246 [*09/16/2017 16:31:54.0699] Dtls Session Established with the AC 192.168.1.51, port 5246 [*09/16/2017 16:31:54.0699] [*09/16/2017 16:31:54.0699] CAPWAP State: Join [*09/16/2017 16:31:54.0699] Sending Join request to 192.168.1.51 through port 5248 [*09/16/2017 16:31:54.0799] Join Response from 192.168.1.51 [*09/16/2017 16:31:54.0799] AC accepted join request with result code: 0 [*09/16/2017 16:31:54.0799] [*09/16/2017 16:31:54.0799] AC IPv4 192.168.1.51, load 8, count 1 [*09/16/2017 16:31:54.1499] NSS Removing existing tunnel 0 [*09/16/2017 16:31:54.1599] cen_platform_add_capwap_hw_tunnel: done, wtp 192.168.1.51, ap 192.168.1.111 [*09/16/2017 16:31:54.1599] CAPWAP data tunnel UPDATE to forwarding SUCCEEDED [*09/16/2017 16:31:54.1899] Starting Post Join timer [*09/16/2017 16:31:54.1899] [*09/16/2017 16:31:54.1899] CAPWAP State: Image Data [*09/16/2017 16:31:54.1899] AP current image version 8.5.103.0 [*09/16/2017 16:31:54.1899] Controller current image version 8.5.103.0 [*09/16/2017 16:31:54.1899] Version is the same, do not need update. [*09/16/2017 16:31:54.2399] do NO_UPGRADE, part2 is active part [*09/16/2017 16:31:54.2399] [*09/16/2017 16:31:54.2399] CAPWAP State: Configure [*09/16/2017 16:31:54.2499] DOT11_CFG[0] Radio Mode is changed from FlexConnect to FlexConnect [*09/16/2017 16:31:54.2499] DOT11_CFG[1] Radio Mode is changed from FlexConnect to FlexConnect [*09/16/2017 16:31:54.3099] LAN update poe_enable 0 override 0 numports 3 portid 1 portenable 0 [*09/16/2017 16:31:54.3099] Configuration Status sent to 192.168.1.51 (part 0) [*09/16/2017 16:31:57.0291] Re-Tx Count=1, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:31:57.0291] [*09/16/2017 16:31:59.8882] Re-Tx Count=2, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:31:59.8882] [*09/16/2017 16:32:02.7373] Re-Tx Count=3, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:02.7373] [*09/16/2017 16:32:05.5964] Re-Tx Count=4, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:05.5964] [*09/16/2017 16:32:08.4455] Re-Tx Count=5, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:08.4455] [*09/16/2017 16:32:11.3046] Re-Tx Count=6, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:11.3046] [*09/16/2017 16:32:11.3046] Max retransmission count exceeded, going back to DISCOVER mode. [*09/16/2017 16:32:11.3046] Dropping msg CAPWAP_CONFIGURATION_STATUS, type = 4, len = 2545, eleLen = 2553, sendSeqNum = 1 [*09/16/2017 16:32:11.3046] GOING BACK TO DISCOVER MODE [*09/16/2017 16:32:11.3046] [*09/16/2017 16:32:11.3046] CAPWAP State: DTLS Teardown [*09/16/2017 16:32:11.3146] [DP] Deleting capwap datapath [*09/16/2017 16:32:11.3146] CAPWAP data tunnel delete from forwarding succeeded [*09/16/2017 16:32:11.3146] Dropping dtls packet since session is not established. Peer 192.168.1.51-5246, Local 192.168.1.111-5248, conn (nil) [*09/16/2017 16:32:16.0531] DTLS session cleanup completed. Restarting capwap state machine. [*09/16/2017 16:32:16.0531] Restarting WLC Discovery [*09/16/2017 16:32:16.0531] Starting Discovery. [*09/16/2017 16:32:16.0531] No uplink IPv6 address [*09/16/2017 16:32:16.0531] IP DNS 8.8.8.8, 0.0.0.0; Domain [*09/16/2017 16:32:16.0531] DHCPv6 conf not found or empty, restart client process. [*09/16/2017 16:32:16.0731] Did not get log server settings from DHCP. [*09/16/2017 16:32:16.0731] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0) [*09/16/2017 16:32:16.0831] Discovery Response from 192.168.1.51 [*09/16/2017 16:32:16.0831] AC IPv4 192.168.1.51, load 5, count 1 [*09/16/2017 16:32:34.4470] Calling wtpGetAcToJoin from timer expiry. [*09/16/2017 16:32:34.4470] DiscRep[0]: addr 192.168.1.51, apMgrCount 1 [*09/16/2017 16:32:34.4470] Selected MWAR 'FulmerME' 192.168.1.51 (index 0). [*09/16/2017 16:32:34.4570] apMgrCount 1, index 0 [*09/16/2017 16:32:34.4570] Adding Ipv4 AP manager 192.168.1.51 to least load [*09/16/2017 16:32:34.4570] WLC: FulmerME ApMgr count 1, ipTransportTried 0, prefer-mode 0, isIpv4OrIpv6Static 0 [*09/16/2017 16:32:34.4570] IPv4 Pref mode. Choosing AP Mgr with index 0, IP 192.168.1.51, load 5, AP ip: (192.168.1.111) [*09/16/2017 16:32:34.4570] capwapSetTransportAddr returning: index 0, apMgrCount 0 [*09/16/2017 16:32:34.4570] [*09/16/2017 16:32:34.4570] Synchronizing time with AC time: 1505579545 [*09/16/2017 16:32:25.0000] can't find the Ip from discoveryRequest array [*09/16/2017 16:32:25.0000] [*09/16/2017 16:32:25.0000] [*09/16/2017 16:32:25.0000] CAPWAP State: DTLS Setup [*09/16/2017 16:32:25.0000] DTLS connection created sucessfully local_ip: 192.168.1.111 local_port: 5248 peer_ip: 192.168.1.51 peer_port: 5246 [*09/16/2017 16:32:25.0599] Dtls Session Established with the AC 192.168.1.51, port 5246 [*09/16/2017 16:32:25.0599] [*09/16/2017 16:32:25.0599] CAPWAP State: Join [*09/16/2017 16:32:25.0699] Sending Join request to 192.168.1.51 through port 5248 [*09/16/2017 16:32:25.0699] Join Response from 192.168.1.51 [*09/16/2017 16:32:25.0699] AC accepted join request with result code: 0 [*09/16/2017 16:32:25.0699] [*09/16/2017 16:32:25.0699] AC IPv4 192.168.1.51, load 8, count 1 [*09/16/2017 16:32:25.1399] NSS Removing existing tunnel 0 [*09/16/2017 16:32:25.1699] cen_platform_add_capwap_hw_tunnel: done, wtp 192.168.1.51, ap 192.168.1.111 [*09/16/2017 16:32:25.1699] CAPWAP data tunnel UPDATE to forwarding SUCCEEDED [*09/16/2017 16:32:25.1999] Starting Post Join timer [*09/16/2017 16:32:25.1999] [*09/16/2017 16:32:25.1999] CAPWAP State: Image Data [*09/16/2017 16:32:25.1999] AP current image version 8.5.103.0 [*09/16/2017 16:32:25.1999] Controller current image version 8.5.103.0 [*09/16/2017 16:32:25.1999] Version is the same, do not need update. [*09/16/2017 16:32:25.2399] do NO_UPGRADE, part2 is active part [*09/16/2017 16:32:25.2399] [*09/16/2017 16:32:25.2399] CAPWAP State: Configure [*09/16/2017 16:32:25.2399] DOT11_CFG[0] Radio Mode is changed from FlexConnect to FlexConnect [*09/16/2017 16:32:25.2399] DOT11_CFG[1] Radio Mode is changed from FlexConnect to FlexConnect [*09/16/2017 16:32:25.3099] LAN update poe_enable 0 override 0 numports 3 portid 1 portenable 0 [*09/16/2017 16:32:25.3099] Configuration Status sent to 192.168.1.51 (part 0) [*09/16/2017 16:32:28.0390] Re-Tx Count=1, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:28.0390] [*09/16/2017 16:32:30.8882] Re-Tx Count=2, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:30.8882] [*09/16/2017 16:32:33.7473] Re-Tx Count=3, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:33.7473] [*09/16/2017 16:32:36.5964] Re-Tx Count=4, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:36.5964] [*09/16/2017 16:32:39.4455] Re-Tx Count=5, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:39.4455] [*09/16/2017 16:32:42.3046] Re-Tx Count=6, Max Re-Tx Value=5, SendSeqNum=1, NumofPendingMsgs=1 [*09/16/2017 16:32:42.3046] [*09/16/2017 16:32:42.3046] Max retransmission count exceeded, going back to DISCOVER mode. [*09/16/2017 16:32:42.3046] Dropping msg CAPWAP_CONFIGURATION_STATUS, type = 4, len = 2545, eleLen = 2553, sendSeqNum = 1 [*09/16/2017 16:32:42.3046] GOING BACK TO DISCOVER MODE [*09/16/2017 16:32:42.3046] [*09/16/2017 16:32:42.3046] CAPWAP State: DTLS Teardown [*09/16/2017 16:32:42.3146] [DP] Deleting capwap datapath [*09/16/2017 16:32:42.3146] CAPWAP data tunnel delete from forwarding succeeded [*09/16/2017 16:32:42.3146] Dropping dtls packet since session is not established. Peer 192.168.1.51-5246, Local 192.168.1.111-5248, conn (nil) Access Point Sh Ver WAP7 uptime is 0 days, 1 hours, 15 minutes Last reload time : Sat Sep 16 14:16:24 UTC 2017 Last reload reason : unknown cisco AIR-OEAP1810-E-K9 ARMv7 Processor rev 0 (v7l) with 477476/214348K bytes of memory. Processor board ID KWC21200CQC AP Running Image : 8.5.103.0 Primary Boot Image : 8.5.103.0 Backup Boot Image : 8.2.151.0 AP Image type : MOBILITY EXPRESS IMAGE AP Configuration : NOT MOBILITY EXPRESS CAPABLE 4 Gigabit Ethernet interfaces 2 802.11 Radios Radio FW version : aa3dba348b0b87165b91a322796b8fd4 NSS FW version : wstephen, Base ethernet MAC Address : 00:42:5A:B8:2A:B0 Part Number : 0-0000-00 PCA Assembly Number : 074-104133-01 PCA Revision Number : 01 PCB Serial Number : KWC21200CQC Top Assembly Part Number : 000-00000-00 Top Assembly Serial Number : KWC24398CAC Top Revision Number : A0 Product/Model Number : AIR-OEAP1810-E-K9   I've run out of ideas as I've upgraded, check the time and defaulted various bits of kit.  The Release notes say they 1810's are compatible so cant explain why they arent assosciating.    Any ideas appreciated.   Regards David ... View more

Content Removed ... View more

Hello all and thanks for reading,  Got a Cisco 867 IOS router with IPSEC VPN config i'm trying to get running.  I get VPN connected but cannot access any internal devices (ive specified the internal IP ranges in the ACL.  I have exactly the same config on another site (different IOS) and it works fine so a bit stumped.  Can anyone see anything I've missed?  VPN config elements in red. Notes: - VPN establishes ok  - IOS firmware c860vae-advsecurityk9-mz.156-2.T1.bin - I can ping the router interfaces over the VPN - I have checked the devices onsite Def Gw's - The site does not have the IPSLA active so no traffic path issues. - From devices onsite I cannot ping the VPN connected device. Traceroute shows traffic gets to the router but no further. - Devices connecting to IPSEC VPN are Apple devices and can be from any public IP. - Getting the following error on debug but then I get connection.  Not getting at other site but it is running earlier firmware "CRYPTO-6-IKMP_MODE_FAILURE: Processing of Aggressive mode failed with peer at "My-Test IP"" Any pointers appreciated. Dave hostname ROUTER ! boot-start-marker boot-end-marker ! ! logging buffered 100000 informational enable secret XXXXXXXXXXXXXXXXXXXX ! aaa new-model ! ! aaa authentication login default local aaa authentication login vpn_xauth_ml_1 local aaa authentication login sslvpn local aaa authentication login http none aaa authorization network vpn_group_ml_1 local ! ! ! ! ! aaa session-id common wan mode ethernet ! ! ! ip dhcp excluded-address 192.168.99.1 192.168.99.99 ip dhcp excluded-address 192.168.99.240 192.168.99.254 ip dhcp excluded-address 192.168.101.1 192.168.101.99 ip dhcp excluded-address 192.168.101.240 192.168.101.254 ip dhcp excluded-address 192.168.102.1 192.168.102.99 ip dhcp excluded-address 192.168.102.120 192.168.102.254 ip dhcp excluded-address 192.168.40.1 192.168.40.99 ip dhcp excluded-address 192.168.40.120 192.168.40.254 ip dhcp excluded-address 192.168.100.1 192.168.100.5 ip dhcp excluded-address 192.168.100.30 192.168.100.35 ip dhcp excluded-address 192.168.100.250 192.168.100.254 ! ip dhcp pool Mgmt network 192.168.99.0 255.255.255.0 default-router 192.168.99.1 dns-server 8.8.8.8 ! ip dhcp pool Site network 192.168.100.0 255.255.255.0 default-router 192.168.100.1 dns-server 8.8.8.8 lease 0 4 ! ip dhcp pool AV network 192.168.101.0 255.255.255.0 default-router 192.168.101.1 dns-server 8.8.8.8 ! ip dhcp pool Voice network 192.168.102.0 255.255.255.0 dns-server 8.8.8.8 default-router 192.168.102.1 ! ip dhcp pool TI network 192.168.40.0 255.255.255.0 default-router 192.168.40.1 dns-server 8.8.8.8 ! ! ! ip inspect name CCP_LOW dns ip inspect name CCP_LOW ftp ip inspect name CCP_LOW h323 ip inspect name CCP_LOW sip ip inspect name CCP_LOW https ip inspect name CCP_LOW icmp ip inspect name CCP_LOW imap ip inspect name CCP_LOW pop3 ip inspect name CCP_LOW rcmd ip inspect name CCP_LOW realaudio ip inspect name CCP_LOW rtsp ip inspect name CCP_LOW esmtp ip inspect name CCP_LOW sqlnet ip inspect name CCP_LOW streamworks ip inspect name CCP_LOW tftp ip inspect name CCP_LOW tcp router-traffic ip inspect name CCP_LOW udp router-traffic ip inspect name CCP_LOW vdolive ip domain name XXXXXXXXXXXXX ip ddns update method dyndns ! ip cef no ipv6 cef ! ! vpdn enable ! vpdn-group 1 ! Default PPTP VPDN group accept-dialin protocol pptp virtual-template 1 ! ! ! ! ! ! ! ! ! crypto pki trustpoint TP-self-signed- XXXXXXXXXXXXXXXXXXXX enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate- XXXXXXXXXXXXXXXXXXXX revocation-check none rsakeypair TP-self-signed-2943135384 ! ! crypto pki certificate chain TP-self-signed- XXXXXXXXXXXXXXXXXXXX certificate self-signed 01 XXXXXXXXXXXXXXXXXXXX quit ! ! username XXXXXXXXXXXXXXXXXXXX privilege 15 password  XXXXXXXXXXXXXXXXXXX X ! ! controller VDSL 0 shutdown ! track 1 ip sla 1 reachability delay down 180 ! ! ! ! ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 ! crypto isakmp client configuration group VPNGroup key XXXXXXXXXXXXXXXXXXXX dns 8.8.8.8 pool vpnpool acl 101 max-users 5 netmask 255.255.255.0 crypto isakmp profile vpn-ike-profile-1 match identity group VPNGroup client authentication list vpn_xauth_ml_1 isakmp authorization list vpn_group_ml_1 client configuration address respond virtual-template 2 ! ! crypto ipsec transform-set encrypt-method-1 esp-3des esp-sha-hmac mode tunnel ! crypto ipsec profile VPN-Profile-1 set transform-set encrypt-method-1 ! ! ! ! ! ! ! interface Loopback1 no ip address ! interface Loopback100 ip ddns update hostname XXXXXXXXXXXXXXXXXXXX ip ddns update dyndns host XXXXXXXXXXXXXXXXXXXX ip address 10.10.10.1 255.255.255.0 ip nat inside ip virtual-reassembly in ! interface ATM0 no ip address shutdown no atm ilmi-keepalive ! interface ATM0.1 point-to-point pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface Ethernet0 no ip address shutdown ! interface FastEthernet0 no ip address ! interface FastEthernet1 no ip address spanning-tree portfast ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address ! interface GigabitEthernet0 switchport mode trunk no ip address ! interface GigabitEthernet1 ip address XXXXXXXXXXXXXXXXXXXX 255.255.255.248 ip access-group INTERNET1 in ip flow ingress ip flow egress ip inspect CCP_LOW out ip nat outside ip virtual-reassembly in duplex auto speed auto ! interface Virtual-Template1 ip unnumbered GigabitEthernet1 ip nat inside ip virtual-reassembly in peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto passive ppp authentication pap chap ms-chap ms-chap-v2 ! interface Virtual-Template2 type tunnel ip unnumbered GigabitEthernet1 tunnel mode ipsec ipv4 tunnel protection ipsec profile VPN-Profile-1 ! interface Vlan1 ip address 192.168.99.1 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Vlan40 description TI Vlan ip address 192.168.40.1 255.255.255.0 ip flow egress ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Vlan100 ip address 192.168.100.1 255.255.255.0 ip flow ingress ip flow egress ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Vlan101 ip address 192.168.101.1 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Vlan102 ip address 192.168.102.1 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Dialer0 ip address XXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXX ip access-group INTERNET in no ip redirects no ip unreachables no ip proxy-arp ip inspect CCP_LOW out ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication chap callin ppp chap hostname XXXXXXXXXXXXXXXXXXXX ppp chap password XXXXXXXXXXXXXXXXXXXX no cdp enable ! ip local pool vpnpool 192.168.255.10 192.168.255.20 ip local pool VPN-Pool 192.168.254.20 192.168.254.25 ip forward-protocol nd ip http server ip http authentication local ip http secure-server ! ip flow-export version 9 ip flow-export interface-names ip flow-export destination XXXXXXXXXXXXXXXXXXXX 9010 ip flow-top-talkers top 15 sort-by packets cache-timeout 360000 ! ip nat inside source static tcp 192.168.99.1 1723 interface GigabitEthernet1 1723 ip nat inside source static tcp 192.168.99.1 22 interface GigabitEthernet1 22 ip nat inside source list 1 interface GigabitEthernet1 overload ip route 0.0.0.0 0.0.0.0 XXXXXXXXXXXXXXXXXXXX track 1 ip route 0.0.0.0 0.0.0.0 192.168.99.254 100 ! ip access-list extended INTERNET1 permit icmp any any echo-reply permit icmp any any unreachable permit icmp any any time-exceeded permit udp host 8.8.8.8 eq domain any permit udp host 8.8.4.4 eq domain any permit gre any any permit tcp any any eq 1723 permit tcp any any eq 22 permit esp any any permit icmp any any permit tcp any any eq 50 permit tcp any any eq 51 permit tcp any any eq 500 permit tcp any any eq 4500 permit udp any any eq 50 permit udp any any eq 51 permit udp any any eq isakmp permit udp any any eq non500-isakmp permit udp any any eq bootps permit udp any any eq bootpc permit udp host XXXXXXXXXXXXXXXXXXXX any permit tcp host XXXXXXXXXXXXXXXXXXXX  any deny ip 192.168.0.0 0.0.0.255 any deny ip 10.0.0.0 0.255.255.255 any deny ip 172.16.0.0 0.15.255.255 any deny ip 127.0.0.0 0.255.255.255 any deny ip host 255.255.255.255 any deny ip host 0.0.0.0 any log ip access-list extended SLAPROBE_ACL permit icmp any host XXXXXXXXXXXX ! ip sla auto discovery ip sla 1 icmp-echo XXXXXXXXXXXXXXXXXXXX source-interface GigabitEthernet1 ip sla schedule 1 life forever start-time now dialer-list 1 protocol ip permit mac-address-table aging-time 20 ! route-map SLAPROBE permit 10 match ip address SLAPROBE_ACL set ip next-hop XXXXXXXXXXXXXXXXXXXX ! route-map Fiber permit 10 match ip address 1 match interface GigabitEthernet1 ! snmp-server community public RO access-list 1 permit any access-list 101 permit ip 192.168.99.0 0.0.0.255 any access-list 101 permit ip 192.168.100.0 0.0.0.255 any access-list 101 permit ip 192.168.40.0 0.0.0.255 any access-list 101 permit ip 192.168.102.0 0.0.0.255 any access-list 101 permit ip 192.168.101.0 0.0.0.255 any ! ! ! ! line con 0 no modem enable line aux 0 line vty 0 4 transport input ssh ! scheduler allocate 20000 1000 ntp server XXXXXXXXXXXXXXXXXXXX event manager applet dyndns event track 1 state up action 1 cli command "en" action 2 cli command "user admin" action 3 cli command "conf t" action 4 cli command "interface loopback 100" action 5 cli command "shut" action 6 cli command "no shut" event manager applet Pri_back event track 1 state any action 2.0 cli command "clear ip nat trans forced" ! ... View more