Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About petenixon
04-09-2019
petenixon
Member since
10-30-2007
Participant
CCNA R&S
I spend a lot of time on the support forums answering questions as my way of giving back to the community that has been so helpful to me in the past.
Created by
petenixon
in VPN and AnyConnect
in VPN and AnyConnect
04-02-2019
02:15 AM
04-02-2019
02:15 AM
Hi Diego, This issue took a great deal of my time and a large part of my sanity! I tried all the things suggested by Francesco above, as well as upgrading the IOS on the hub and spoke routers, as well as running multiple debugs on both peers but I wasn't able to pin point the cause (I was able to rule out congestion on the spoke router too). The issue disappeared about two weeks later, which made me suspect an issue in our provider network. However I was unable to prove it, and they didn't admit to any problems (make of that what you will). I would certainly try the steps taken by myself and suggested by Francesco as your problem may be slightly different from my own.
... View more
Created by
petenixon
in Integrated Security Architecture
in Integrated Security Architecture
08-07-2018
11:26 AM
08-07-2018
11:26 AM
no feature http-server
Check whether it's been enabled though by using:
show feature
... View more
Created by
petenixon
in Integrated Security Architecture
in Integrated Security Architecture
08-07-2018
06:22 AM
08-07-2018
06:22 AM
You're right. I think what I should have wrote is remove from a scan that's targeting servers, and run a separate scan against network devices.
Tenable (as an example) has plugins (depending on the license) to scan specific device types.
... View more
Created by
petenixon
in Integrated Security Architecture
in Integrated Security Architecture
08-07-2018
05:59 AM
08-07-2018
05:59 AM
It will.
I'd also make sure you exclude that address from future vulnerability scans.
... View more
Created by
petenixon
in Integrated Security Architecture
in Integrated Security Architecture
08-07-2018
05:23 AM
08-07-2018
05:23 AM
no ip http secure-server
no ip http server
... View more
08-07-2018
04:09 AM
Hi,
You'll be limited on a switch to the maximum number of access control entries which are defined by whichever SDM template you are using. You can check your current SDM template by using the command:
show sdm prefer
And again, I would follow that up by checking the TCAM utilisation using the command in my previous post.
I would say that any ACL is too large if you can summarise some of the entries and you're not doing that. I would definitely offload any ACLs that you can to a firewall (if you have one). I'd also log the entries until you can see which ones are actually needed.
Out of interest, how are you evidencing the traffic interruption?
... View more
08-06-2018
09:01 AM
Hi,
I think that's expected behaviour if you have a really large ACL, the switch will need to "recompile" it if you make a change to it. Best practice however, is to remove an ACL before you make a change. Once removed, you can make your change before you re-apply it to the interface.
ACE's are stored in the TCAM on a switch, so I would take a look at the TCAM utilisation in case you have other long ACLs that are causing resource exhaustion:
show platform tcam utilization
... View more
Created by
petenixon
in Integrated Security Architecture
in Integrated Security Architecture
08-06-2018
08:31 AM
08-06-2018
08:31 AM
Hi,
I don't believe you can specifically disable SSLv3 or v2, or more specifically, there isn't a command to turn them off. Although, a 'no sslv3' would be a great command under the circumstances!
I would approach this one of two ways:
1. I would try and mitigate that risk by ensuring that only trusted hosts are allowed to connect to the switch.
or
2. Configure a certificate authority for signing certificates, and configuring of specific cipher suites:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01010.html#d72206e37a1635
That being said, the vulnerability report is probably more interested in your web servers!
... View more
Created by
petenixon
in VPN and AnyConnect
in VPN and AnyConnect
10-03-2017
06:58 AM
10-03-2017
06:58 AM
Hi Francesco, Thanks for the reply. Keep-alive value is the same on both peers: crypto isakmp keepalive 30 5 Unfortunately, we use only the one profile so any changes will affect all the peers. Although, in the grand scheme of things, all the peers are having the same problem so probably won't hurt to try. It's a good idea with running the debug on the peer router as well as the hub, i think i'll do that first before i change the keepalive value. Thanks.
... View more
Created by
petenixon
in VPN and AnyConnect
in VPN and AnyConnect
10-03-2017
05:55 AM
10-03-2017
05:55 AM
Hi all, I'm looking for some advice with an issue i'm having with my DMVPN peers. I'm getting, periodically, the following log message on my hub router (ASR 1000) which is causing a BGP flap everytime it happens (which is around every 7-8 hours daily): %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=X.X.X.X, prot=50, spi=0x1F670EE6(526847718), srcaddr=X.X.X.X, input interface=Tunnel402 My initial step was to upgrade the IOS on a spoke router (which was running on old code) which seemed to solve the problem for a day or two, but the problem soon re-occured. I've ran a debug on the hub router and I think i understand what's happening, but i'm not sure why it's happening: 1. DPD times out and deletes the SA: Oct 2 09:09:17.464 GMT: ISAKMP:(57964):DPD incrementing error counter (5/5) Oct 2 09:09:17.464 GMT: ISAKMP:(57964):peer X.X.X.X not responding! Oct 2 09:09:17.465 GMT: ISAKMP:(57964):peer does not do paranoid keepalives. Oct 2 09:09:17.465 GMT: ISAKMP:(57964):deleting SA reason "End of ipsec tunnel" state (R) QM_IDLE (peer X.X.X.X) Oct 2 09:09:17.465 GMT: ISAKMP:(57964):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_PEERS_ALIVE Oct 2 09:09:17.465 GMT: ISAKMP:(57964):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE Oct 2 09:09:17.465 GMT: Delete IPsec SA by DPD, local X.X.X.X remote X.X.X.X peer port 49919 Oct 2 09:09:17.465 GMT: IPSEC(delete_sa): SA found saving DEL kmi Oct 2 09:09:17.466 GMT: ISAKMP: set new node 4281106041 to QM_IDLE Oct 2 09:09:17.466 GMT: ISAKMP:(57964): sending packet to X.X.X.X my_port 4500 peer_port 49919 (R) QM_IDLE 2. Recieve a packet from the spoke which generates the invalid SPI log message as the SA has been deleted: Oct 2 09:09:18.131 GMT: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=X.X.X.X, prot=50, spi=0x1F670EE6(526847718), srcaddr=X.X.X.X, input interface=Tunnel402 3. Initial contact for main mode: Oct 2 09:09:37.522 GMT: ISAKMP (57964): received packet from X.X.X.X dport 4500 sport 49993 DMVPN (R) MM_NO_STATE Oct 2 09:09:42.522 GMT: ISAKMP (57964): received packet from X.X.X.X dport 4500 sport 49993 DMVPN (R) MM_NO_STATE Oct 2 09:09:47.522 GMT: ISAKMP (57964): received packet from X.X.X.X dport 4500 sport 49993 DMVPN (R) MM_NO_STATE Oct 2 09:09:52.521 GMT: ISAKMP (57964): received packet from X.X.X.X dport 4500 sport 49993 DMVPN (R) MM_NO_STATE Oct 2 09:09:57.521 GMT: ISAKMP (57964): received packet from X.X.X.X dport 4500 sport 49993 DMVPN (R) MM_NO_STATE Oct 2 09:10:02.523 GMT: ISAKMP (57964): received packet from X.X.X.X dport 4500 sport 49993 DMVPN (R) MM_NO_STATE Oct 2 09:10:02.524 GMT: ISAKMP (57964): received packet from X.X.X.X dport 4500 sport 49993 DMVPN (R) MM_NO_STATE Oct 2 09:10:06.611 GMT: ISAKMP: local port 500, remote port 18246 Oct 2 09:10:06.611 GMT: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 7FBDAE0C3008 Oct 2 09:10:06.611 GMT: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Oct 2 09:10:06.611 GMT: ISAKMP:(0):Old State = IKE_READY New State = IKE_R_MM1 Oct 2 09:10:06.611 GMT: ISAKMP:(0): processing SA payload. message ID = 0 Oct 2 09:10:06.611 GMT: ISAKMP:(0): processing vendor id payload Oct 2 09:10:06.611 GMT: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch Oct 2 09:10:06.611 GMT: ISAKMP (0): vendor ID is NAT-T RFC 3947 Oct 2 09:10:06.611 GMT: ISAKMP:(0): processing vendor id payload Oct 2 09:10:06.611 GMT: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch Oct 2 09:10:17.468 GMT: ISAKMP:(57964):purging SA., sa=7FBDADB56050, delme=7FBDADB56050 4. BGP peer drops 5. VPN comes up and the BGP peering comes back up. My current thinking is that there's (possibly) congestion at the spoke site that's causing the problem and increasing the keep-alive may solve the problem as the spoke does respond, although not before the SA is deleted? Comments and suggestions are welcome. Thanks.
... View more
Labels:
03-17-2016
10:08 AM
Hi.
You can substitute the 3560 for whichever model switch you have and apply the config to it.
... View more
10-30-2015
06:32 AM
Hi all,
I want to upgrade a 5508 WLC which is currently running 7.0.116.0 to 7.4.130.0. The FUS on the controller is 6.0.182.0 and in the release notes it is recommended to use 1.7.0.0-FUS (which is no longer available).
Can I bypass the FUS upgrade (which i'd rather not do) or just go straigh to 1.9?
Thanks.
... View more
Labels:
07-23-2015
01:22 AM
Hi Luke, You can create two vlan interfaces in the 887, one for vlan 1 connected to your superhub and another for all your connected devices and nat between the two interfaces and you can also route between the two networks using the 887 router. Let me know if you get stuck with the config. Cheers, Pete.
... View more
Created by
petenixon
in VPN and AnyConnect
04-02-2019 02:15 AM
04-02-2019 02:15 AM
Hi Diego, This issue took a great deal of my time and a large part of my
sanity! I tried all the thi...
Created by
petenixon
in Integrated Security Architecture
08-07-2018 11:26 AM
08-07-2018 11:26 AM
no feature http-server Check whether it's been enabled though by using:
show feature
Created by
petenixon
in Integrated Security Architecture
08-07-2018 06:22 AM
08-07-2018 06:22 AM
You're right. I think what I should have wrote is remove from a scan
that's targeting servers, and r...
Created by
petenixon
in Integrated Security Architecture
08-07-2018 05:59 AM
08-07-2018 05:59 AM
It will. I'd also make sure you exclude that address from future
vulnerability scans.
Created by
petenixon
in Integrated Security Architecture
08-07-2018 05:23 AM
08-07-2018 05:23 AM
no ip http secure-server no ip http server
Created by
petenixon
in Integrated Security Architecture
08-06-2018 08:31 AM
08-06-2018 08:31 AM
Hi, I don't believe you can specifically disable SSLv3 or v2, or more
specifically, there isn't a co...
Created by
petenixon
in VPN and AnyConnect
10-03-2017 06:58 AM
10-03-2017 06:58 AM
Hi Francesco, Thanks for the reply. Keep-alive value is the same on both
peers:crypto isakmp keepali...
10-03-2017 05:55 AM
Hi all,I'm looking for some advice with an issue i'm having with my
DMVPN peers. I'm getting, period...
03-17-2016 10:08 AM
Hi. You can substitute the 3560 for whichever model switch you have and
apply the config to it.
10-30-2015 06:32 AM
Hi all, I want to upgrade a 5508 WLC which is currently running
7.0.116.0 to 7.4.130.0. The FUS on t...
Public Statistics
| Date Registered | 10-30-2007 06:25 AM |
| Date Last Visited | 04-09-2019 02:16 AM |
| Total Messages Posted | 182 |
| Total Helpful Votes Received | 50 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 10 | |
| 5 | |
| 5 | |
| 4 | |
| 5 |
.jpg "VIP Mentor"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 15 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
