Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About aacole
Stats
Member since
02-07-2002
585
Posts
181
Helpful
16
Solutions
Created by
aacole
in Policy and Access
in Policy and Access
05-10-2018
09:54 AM
05-10-2018
09:54 AM
An update on this issue, I restarted the CSR1000 in my virl topology to clear out the config (I'd purposefully not saved it), and started again.
I get the same, no connection but now my public keys match, which they didn't before, when I re-looked at my data. Also I've got additional debug from the client and server, attached.
The router debug shows that its unable to locate the public key for my configured username, but the show run | beg pubkey output shows its there.
... View more
Created by
aacole
in Policy and Access
in Policy and Access
05-10-2018
08:02 AM
05-10-2018
08:02 AM
Hi, I'm attempting to setup SSH between my Ubuntu client and CSR 1000 router in VIRL running 16.5.1b with SSH keys so that I don't need to enter a password, its for an Ansible lab I'm working on. Prior to setting this up I had regular password authentication working, so when I SSH'ed from my client to this router I logged in with a passwortd as normal, so I know I have basic IP connectivity.
I've generated the client key as follows:
ssh-keygen
I can see the key with:
cat ~/.ssh/id_rsa.pub And found information that explained how to breakup the key into shorter lines:
fold -b -w 72 ~/.ssh/id_rsa.pub
I checked the RSA key fingerprint with:
ssh-keygen -lf ~/.ssh/id_rsa.pub 2048 SHA256:OURv0YmzLD1xC8mSihmELU2tEgHuETnkkcZ4jGLRP8w andyc@ubuntu (RSA)
On the router I configured:
ip domain-name cisco.com
ip ssh pubkey-chain username andyc key-string
< pasted output from cat ~/.ssh/id_rsa.pub on the client >
I can see the fingerprint with:
show run | beg pubkey
ip ssh pubkey-chain username andyc key-hash ssh-rsa 81AB71B476661EB1D248EC2CAE1CCFDF andyc@ubuntu username andy key-hash ssh-rsa FA570736F0B4C3AE9837A50F79380B91 ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr ip ssh server algorithm authentication publickey ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr
When I attempt to connect from the client with:
ssh andyc@192.168.255.1
It fails to connect, with no error message on the router console.
Debug shows:
*May 10 13:52:02.229: SSH0: protocol version id is - SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 *May 10 13:52:02.291: SSH2 0: Using kex_algo = diffie-hellman-group-exchange-sha1 *May 10 13:52:02.669: SSH0: TCP send failed enqueueing *May 10 13:52:05.301: SSH0: Session disconnected - error 0x00
What i did notice from this is that the fingerprints don't match, I'm not sure if they should, but its somehow feels wrong that they don't match, can someone clarify this please.
At this stage, I'm out of ideas on what to do next to try and get this working, any suggestions welcome. I've attached the router config for reference.
Andy
... View more
Labels:
08-16-2017
10:33 PM
Hi Rob,
The output of show crypto pki certificates, I'm not sure why there are 3, and/or if they are all relevant to my current setup, or hangovers from previous configuration attempts:
Router Self-Signed Certificate Status: Available Certificate Serial Number (hex): 01 Certificate Usage: General Purpose Issuer: cn=IOS-Self-Signed-Certificate-2069616539 Subject: Name: IOS-Self-Signed-Certificate-2069616539 cn=IOS-Self-Signed-Certificate-2069616539 Validity Date: start date: 14:30:27 BST Aug 15 2017 end date: 00:00:00 UTC Jan 1 2020 Associated Trustpoints: TP-self-signed-2069616539 Storage: nvram:IOS-Self-Sig#2.cer CA Certificate Status: Available Certificate Serial Number (hex): 01 Certificate Usage: Signature Issuer: cn=CA_SERVER Subject: cn=CA_SERVER Validity Date: start date: 07:08:13 BST Aug 15 2017 end date: 00:38:57 BST Jul 11 1901 Associated Trustpoints: ROUTER CA_SERVER Storage: nvram:CA_SERVER#1CA.cer Certificate Subject: Name: R1.uwfra.org.uk IP Address: <my public IP> Status: Pending Key Usage: General Purpose Certificate Request Fingerprint MD5: AA4A383C 2C6B21E3 19D6D1CF 589665C6 Certificate Request Fingerprint SHA1: E401C1C1 8B1C263A CCF976D2 A0B4D402 BA43E9FB Associated Trustpoint: ROUTER
The image is:
System image file is "flash:c860vae-advsecurityk9-mz.155-3.M.bin"
The router is an old c860:
Cisco 867VAE-K9 (revision 0.3)
I'm thinking of going for an ASA instead for my RA termination, have you got Anyconnect working over IPSec to a router? I'm sure this should work!
... View more
08-15-2017
12:28 PM
I checked this earlier, and have just had another look:
sh crypto pki server CA_SERVER req The Enrollment Request Database is empty. R1#
Here is my complete crypto config:
crypto pki server CA_SERVER database level names no database archive hash sha512 lifetime certificate 3650 lifetime ca-certificate 7305 23 59 auto-rollover 365 eku server-auth client-auth database url flash:ca ! crypto pki trustpoint CA_SERVER revocation-check crl rsakeypair CA_SERVER ! crypto pki trustpoint ROUTER enrollment url http://<my pub ip>:80 ip-address <my pub ip> subject-name CN=Hut,OU=user-vpn,O=UWRFA revocation-check crl rsakeypair ROUTER_KEY auto-enroll regenerate hash sha512
crypto pki certificate chain CA_SERVER certificate ca 01 30820506 308202EE A0030201 02020101.......
crypto pki certificate chain ROUTER certificate ca 01 30820506 308202EE A0030201 02020101........
The trustpoints are:
sh crypto pki trustpoints Trustpoint CA_SERVER: Subject Name: cn=CA_SERVER Serial Number (hex): 01 Certificate configured. Trustpoint ROUTER: Subject Name: cn=CA_SERVER Serial Number (hex): 01 Certificate configured. SCEP URL: http://<my pub ip>:80/cgi-bin Trustpoint TP-self-signed-2069616539: Subject Name: cn=IOS-Self-Signed-Certificate-2069616539 Serial Number (hex): 01 Persistent self-signed certificate trust point Using key label TP-self-signed-2069616539
... View more
08-15-2017
06:46 AM
Hi Rob,
Following your reply I realised that the router has zone based Firewall configured, and that was preventing the router communicating with the server on the same router.
Now I'm getting furthur.
I've run the crypto pki authernicate ROUTER comand, which was succesfull as far as I can tell.
But when I get to the enrollment stage, crypto pki enroll ROUTER, I'm seeing
Error: There is an auto enrollment transaction in progress. Please wait until the current auto enrollment to finish before starting a new enrollment transaction.
A quick check on Google reveals:
CSCuo50815 IOS PKI: auto-renewal fails if the first renewal attempt is inturrupted
Workaround is a reboot, which I've tried, made no difference, got the same error message.
I'm not sure if I've hit this bug, as the reload made no difference.
My server config is:
crypto pki server CA_SERVER database level names no database archive hash sha512 lifetime certificate 3650 lifetime ca-certificate 7305 23 59 auto-rollover 365 eku server-auth client-auth database url flash:ca
Any more thoughts?
... View more
08-15-2017
12:21 AM
Did you manage to get this working? I have the same requirement, to use Anyconnect client with an IPSec connection.
I found the same document on ifm.net referred to above, and magaed to get a bit furthur than Alex, my CA server on the router was running:
R1#sh crypto pki server Certificate Server CA_SERVER: Status: enabled State: enabled Server's configuration is locked (enter "shut" to unlock it) Issuer name: CN=CA_SERVER
But I fail at the next step, creating a trustpoint on the router:
crypto key generate rsa general modulus 2048 exportable label ROUTER_KEY
crypto pki trustpoint ROUTER enrollment url http://<my ip addr>:80 ip-address <my ip addr> subject-name CN=Hut,OU=user-vpn,O=UWRFA revocation-check crl rsakeypair ROUTER_KEY auto-enroll regenerate hash sha512 exit
sh crypto pki trustpoints Trustpoint CA_SERVER: Subject Name: cn=CA_SERVER Serial Number (hex): 01 Certificate configured. Trustpoint ROUTER:
This section is empty, so I assume something is missing when I tried to configure the trustpoint!
And therefore the authenticate step fails:
crypto pki authenticate ROUTER % Error in receiving Certificate Authority certificate: status = FAIL, cert length = 0
I'm still working on this, currently I cannot establish where I've gone wrong.
... View more
08-08-2017
02:20 AM
For some self study I've been attempting to configure WebVPN on a C860 running this code:
Cisco IOS Software, C860 Software (C860VAE-ADVSECURITYK9-M), Version 15.5(3)M
Following a guide on Cisco on how to set this up I get to the point where I configure the webvpn gateway, but the webvpn command is not recognised.
I'm coming to the conclusion that although the 15.5 version should support this feature its not supported in my hardware/image combination.
The feature navigator doesn't seem to cover the 15.5 images, so that isn't much help either.
Is my conclusion correct, or is there another image that I can use with the c860VAE to get this to work?
Cheers
Andy
... View more
Labels:
03-06-2017
09:08 AM
Yes, DMVPN does support the use of multicast sources behind spokes.
Set the RP to be at the hub site, set PIM so that the hub becomes the DR.
All replication takes place at the hub. I have this working now, with multicast sources and receivers behind each DMVPN node.
... View more
01-26-2017
03:56 AM
Just one odd issue that might be relevant, I was testing with Win 7 PC's, and found that on my IOS the IGMP v3 join was ignored by the 2811 I was using. But if I swapped that for a later router (867VAE) the win 7 IGMP v3 join was accepted!
Go figure that one. The 2811's work fine with the digital radios and IGMP v3, so I'm not too concerned about this, I found whilst testing with VLC to multicast a video stream.
... View more
01-26-2017
03:52 AM
Some basic multicast troubleshooting step:
1, can you ping the RP address on the hub from the LAN interface on a spoke?
2, If you are using static RP's (keep it simple!) does your spoke have a config entry for the RP? Also check the multicast group is allowed by any ACL this entry auto created:
ip pim rp-address 10.1.1.255 MULTICAST
ip access-list standard MULTICAST permit 239.255.0.0 0.0.255.255
3, start your multicast stream, check the ipmroute table on the local router to make sure there is a S,G entry, which will be <source ip>, <mcast group ip>
4, at the spoke try to join the stream, the spoke router should create an entry under " sh ip igmp group" if it does, look at the ipmroute table, do you see an S,G entry created for the source to host multicast stream?
I use VLC for testing multicast, take a look at http://peakdrive.com/?p=440 for more info, or ask here
Let me know you get on. I've just set this up last night!
Andy
... View more
01-23-2017
06:06 AM
Hi Yes, I have it working. I tried to reply from my phone, but it seems my reply never got uploaded.
I set the RP (static) on the one hub I have. Each spoke has a static entry for the hub RP address. Each link is using PIM sparse mode and IGMP v3 on the LAN facing interfaces.
On the hub tunnel interface set:
ip pim dr-priority 2
ip pim nbma-mode
on the spoke tunnel interfaces set:
ip pim dr-priority 0
ip pim nbma-mode
If your multicast source is behind the hub then this should work. If you have multicast sources behind spokes (as I have) then you need to set the following, only on the spoke routers:
ip pim spt-threshold infinity.
This command forces the spoke to spoke multicast traffic to stay on the shared path back towards the RP at the hub, the hub router then replicates this traffic back to the destination spoke which has requested to join the stream.
Andy
... View more
11-18-2016
09:10 AM
For info here is the output from another session this afternoon, shows the available commands and the results when trying to access the various file systems.
System Bootstrap, Version 15.1(4r)M2, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2011 by cisco Systems, Inc. C860VAE ipbase platform with 256 MB of main memory [BREAK KEY] monitor: command "boot" aborted due to user interrupt rommon 1 > help alias set and display aliases command boot boot up an external process confreg configuration register utility delete delete file from flash: file system. delete <flash:filename> dev list the device table dir list files in flash file system format Format flash: file system or disaster recovery for flash: help monitor builtin command help history monitor command history meminfo main memory information repeat repeat a monitor command reset system reset set display the monitor variables showmon display currently selected ROM monitor sync write monitor environment to NVRAM tftpdnld tftp image download unalias unset an alias unset unset a monitor variable rommon 2 > rommon 2 > USB inserted monitor: command "USB" not found rommon 3 > rommon 3 > dev Devices in device table: id name flash: flash bootflash: boot flash usbflash0: usbflash0 rommon 4 > dir usbflash0: File system is not ready to use. Please reset before access file system rommon 5 > format usbflash0: File system is not ready to use. Please reset before access file system rommon 6 > dir File system is not ready to use. Please reset before access file system rommon 7 > dir bootflash: File system is not ready to use. Please reset before access file system rommon 8 > boot flash Please reset before booting rommon 9 > dir flash: File system is not ready to use. Please reset before access file system rommon 10 >
A reset results in:
rommon 14 > reset System Bootstrap, Version 15.1(4r)M2, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2011 by cisco Systems, Inc. C860VAE ipbase platform with 256 MB of main memory Booting flash:/c860vae-advsecurityk9-mz.156-2.T1.bin boot: Launch entrypt: 0x80800000 Self decompressing the image : #################################### Wrong IOS image on IPBASE Router System reload in 5 seconds
... View more
11-17-2016
04:37 AM
Having spent another hour or so looking at this I've decided its scrap. The tftpdnld option is provided, and an option to boot up from an external process, but both result in the following message:
File system is not ready to use. Please reset before access file system
When I reset it restarts then outputs:
Wrong IOS image on IPBASE Router System reload in 5 seconds
There is no xmodem facility.
Its going in the bin!
... View more
11-17-2016
01:00 AM
Thanks Leo,
I've already tried several USB sticks, including a Cisco one.
Looks like I'll have to fallback on the older trusted recover methods then, I was hoping for an easy recovery process!
Cheers,
Andy
... View more
11-16-2016
07:34 AM
Hi, after I upgraded this 867VAE (an IP base model) to run advsecurity it failed to boot and I then discovered these routers can only run ip base images.
So, no problem I thought, put into rommon and boot from a USB device, a procedure I very familiar with. However, I get an error indicating the file system is not ready. The drive is formatted as FAT32.
MY question, is can I recover this router by any method, or is it scrap? I had to delete the ip base image as there isn't enough space to take both.
* Additional info:
from rommon when I enter dev I see usbflash0: as an option
But dir and dir usbflash0: results in:
File system is not ready to use
Please reset before access file system
reset results in a reload.
I found a reference which states that the USB has to be FAT 32 and less than 2Gb which is is.
... View more
Labels:
Created by
aacole
in Policy and Access
05-10-2018
05-10-2018
An update on this issue, I restarted the CSR1000 in my virl topology to
clear out the config (I'd pu...
Created by
aacole
in Policy and Access
05-10-2018
05-10-2018
Hi, I'm attempting to setup SSH between my Ubuntu client and CSR 1000
router in VIRL running 16.5.1b...
Created by
aacole
in Data Center Switches
12-18-2017
12-18-2017
Hi, so I can get a better understanding of VXLAN/EVPN I am attempting to
set this up in VIRL. I'm wo...
08-16-2017
Hi Rob, The output of show crypto pki certificates, I'm not sure why
there are 3, and/or if they are...
08-15-2017
I checked this earlier, and have just had another look: sh crypto pki
server CA_SERVER req The Enrol...
08-15-2017
Hi Rob, Following your reply I realised that the router has zone based
Firewall configured, and that...
08-15-2017
Did you manage to get this working? I have the same requirement, to use
Anyconnect client with an IP...
08-08-2017
For some self study I've been attempting to configure WebVPN on a C860
running this code: Cisco IOS ...
03-06-2017
Yes, DMVPN does support the use of multicast sources behind spokes. Set
the RP to be at the hub site...
01-26-2017
Just one odd issue that might be relevant, I was testing with Win 7
PC's, and found that on my IOS t...
01-26-2017
Some basic multicast troubleshooting step: 1, can you ping the RP
address on the hub from the LAN in...
01-23-2017
Hi Yes, I have it working. I tried to reply from my phone, but it seems
my reply never got uploaded....
11-18-2016
For info here is the output from another session this afternoon, shows
the available commands and th...
11-17-2016
Having spent another hour or so looking at this I've decided its scrap.
The tftpdnld option is provi...
Public Statistics
| Date Registered | 02-07-2002 07:17 AM |
| Date Last Visited | 06-06-2018 09:21 AM |
| Total Messages Posted | 585 |
| Total Helpful Votes Received | 181 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 10 | |
| 5 |
.jpg "VIP Advisor"){kind=icon}
Helpful Votes From
