Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Marcin Latosiewicz
05-22-2019
Stats
Member since
01-03-2008
2897
Posts
1652
Helpful
391
Solutions
08-07-2017
04:29 AM
Of course you're correct. Reference:
https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
Unfortunately I can't rate your answer, the rating button is not available :{
... View more
Created by
Marcin Latosiewicz
in VPN and AnyConnect
in VPN and AnyConnect
09-16-2016
06:54 AM
09-16-2016
06:54 AM
NHRP is L2 protocol, VTI is a L3 encapsulation. So yes, you do need GRE (default).
... View more
05-23-2016
04:53 AM
ASA does not support virtual interfaces for VPN - it does support IKEv2 for Remote access and L2L VPN tho.
1800 series routers' images do not have IKEv2 compiled in.
... View more
03-18-2016
07:41 AM
Mind that I haven't been working on this tech for almost 3 years. The aaa authorization rule is not defined under AAA, you have it defined only in IKE. Maybe newer IOS don't require it? The old ones did.
... View more
03-15-2016
06:25 AM
Spoke doesn't have an identity cert.
Enroll the spoke to CA (yes, itself). Also make sure you have the right EKU (If this restriction was not relaxed recently).
... View more
02-17-2016
11:24 PM
Split tunnelling being enabled or disabled is a matter of policy typically, this particular example outlines some of advantages of logical interfaces irt traffic flow.
Yes it could solve the u-turn problem by essentially not sending traffic towards the headend, but it requires additional configuration.
It's also worth mentioning that the two features are not exclusive, you can run VTI with split tunnelling.
... View more
11-26-2015
01:45 AM
Is the OS using CGA?
https://en.wikipedia.org/wiki/Cryptographically_Generated_Address
... View more
10-16-2015
02:04 AM
Mohan,
But there is no data plane routing on FIs, NXOS. Let me demonstrate.
bdsol-6296-01-B (nxos)# show ip route
IP Route Table for VRF "default
'*' denotes best ucast next-hop
'**' denotes best mcast next-hop
'[x/y]' denotes [preference/metric]
bdsol-6296-01-B(nxos)# show ip route vrf management
No IP Route Table for VRF "management"
bdsol-6296-01-B(nxos)# sh run int mgmt 0
!Command: show running-config interface mgmt0
!Time: Fri Oct 16 11:02:50 2015
version 5.2(3)N2(2.23d)
interface mgmt0
shutdown force
ip address 10.48.43.82/25
Hope that clears things up.
M.
... View more
Created by
Marcin Latosiewicz
in Unified Computing System Discussions
in Unified Computing System Discussions
10-15-2015
01:46 PM
10-15-2015
01:46 PM
UCS/Fabric Interconnects are not routing devices. The operate either in end host or FC/Ether switching modes (the former being recommended for most deployments).
... View more
Created by
Marcin Latosiewicz
in VPN and AnyConnect
in VPN and AnyConnect
10-14-2015
06:53 AM
10-14-2015
06:53 AM
tunnel mode ipsec ipv4 <--- NHRP in IP world, may not work ... Try with GRE? 1544368: Oct 14 12:58:56.881 CEST: NHRP: Virtual-Access3: Tunnel mode changed from 'Uninitialized tunnel mode' to 'GRE over point to point IPV4 tunnel mode' 1544369: Oct 14 12:58:56.881 CEST: NHRP: Virtual-Access3: NHRP not enabled interface Virtual-Template10 type tunnel ip unnumbered Tunnel0 <--- why tunnel 0 and not the LAN VRF configuration?
... View more
Created by
Marcin Latosiewicz
in Unified Computing System Discussions
in Unified Computing System Discussions
10-11-2015
03:26 AM
10-11-2015
03:26 AM
Do you mean the capability catalog? If so, Cisco is releasing upgraded version (/revisions) of components all the time. Compatibility catalog is a way to have those new subsystems function without a new to upgrade the core systems (NXOS, UCSM etc). Catalog upgrade is seamless and does not require any reloads. There should not be a need to rollback a capability catalog upgrade, it's a pretty small XML file containing known/supports UCS components.
... View more
Created by
Marcin Latosiewicz
in VPN and AnyConnect
in VPN and AnyConnect
09-29-2015
04:54 AM
09-29-2015
04:54 AM
In quite practical terms IKE phase 1 authentication and rekey authentication should be using separate RSA key pair. Check out the redundant KS design in GETVPN DIG. DIG A.2.1. Yes your TEK will be propagated across entire domain and used for encryption. DIG 3.5.3 Indeed a rekey happens when a new policy (what to encrypt and how to encrypt) is set , but also periodically to avoid encryption key from being compromised, as is usual with IPsec encryption. DIG 3.5.3.
... View more
Created by
Marcin Latosiewicz
in Other Data Center Subjects
in Other Data Center Subjects
09-28-2015
05:36 AM
09-28-2015
05:36 AM
Probably best doc we have is from MDS family: http://www.cisco.com/c/en/us/products/collateral/storage-networking/mds-9700-series-multilayer-directors/white_paper_c11-729444.html Long story (very) short is that you can detect ports spending prolonged time waiting for credits to be returned. There are also some default actions FC switches will perform. I don't believe there's a specific document out for Nexus 5k family.
... View more
09-28-2015
05:31 AM
Truth be told best way to check who's starting QM exchange causing those SPIs to be introduced. I can't do it for you, but we've written a guide a couple of years back: http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/113594-trouble-ios-ike-00.html Experience wise, I have not seen IOS introduce in IKEv1 a transform set it's not configured to use. IKEv2 and smart defaults are a bit different.
... View more
Created by
Marcin Latosiewicz
in VPN and AnyConnect
in VPN and AnyConnect
09-28-2015
05:28 AM
09-28-2015
05:28 AM
Look into NHRP holdtimes and registration timers. The default values are quite long.
... View more
08-07-2017
Of course you're correct. Reference:
https://www.iana.org/assignments/protocol-numbers/protocol-numb...
05-23-2016
ASA does not support virtual interfaces for VPN - it does support IKEv2
for Remote access and L2L VP...
03-18-2016
Mind that I haven't been working on this tech for almost 3 years. The
aaa authorization rule is not ...
03-15-2016
Spoke doesn't have an identity cert. Enroll the spoke to CA (yes,
itself). Also make sure you have t...
02-17-2016
Split tunnelling being enabled or disabled is a matter of policy
typically, this particular example ...
10-16-2015
Mohan, But there is no data plane routing on FIs, NXOS. Let me
demonstrate. bdsol-6296-01-B(nxos)# s...
Created by
Marcin Latosiewicz
in Unified Computing System Discussions
10-15-2015
10-15-2015
UCS/Fabric Interconnects are not routing devices. The operate either in
end host or FC/Ether switchi...
10-14-2015
tunnel mode ipsec ipv4 <--- NHRP in IP world, may not work ... Try with
GRE? 1544368: Oct 14 12:58:5...
Created by
Marcin Latosiewicz
in Unified Computing System Discussions
10-11-2015
10-11-2015
Do you mean the capability catalog?If so, Cisco is releasing upgraded
version (/revisions) of compon...
09-29-2015
In quite practical terms IKE phase 1 authentication and rekey
authentication should be using separat...
09-28-2015
Probably best doc we have is from MDS family:
http://www.cisco.com/c/en/us/products/collateral/stora...
09-28-2015
Truth be told best way to check who's starting QM exchange causing those
SPIs to be introduced. I ca...
Public Statistics
| Date Registered | 01-03-2008 12:25 AM |
| Date Last Visited | 05-22-2019 12:07 AM |
| Total Messages Posted | 2,897 |
| Total Helpful Votes Received | 1652 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 10 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
