Thanks for sharing the output. As I suspected you have not explicitly configured a loopback interface with the address 127.0.0.1, and IOS does not configure one by default like a computer Operating System does. On this basis a ping to 127.0.0.1 will always fail.   cheers, Seb. ... View more

Agreed, but how would cisco put food on its table if users just held onto their hardware until it burnt out. Obsolescence is achieved through lack feature support and an ever growing list of security vulnerabilities! That is the reality of proprietary IT.   Anyhow...years ago when IPv6 support was very limited on cisco kit we used the radvd service on linux to provide our RA broadcasts. I see it now supports RDNS. To get this working you'd need to configure a sub-interface on every VLAN in your network and confirm with infosec that you cannot route between them.   https://linux.die.net/man/8/radvd   cheers, Seb. ... View more

Hi Andy, As you point out, both platforms are in their EoL phases in fact both have sailed past the 'last date of support' marks, crucially the last software maintenance date was 4 years ago.   You will not see RA DNS support on these platforms. Time to upgrade or move the function to an existing platform which does.   cheers, Seb. ... View more

Hi there, No it does not support netflow, but it can send sFlow data to external collectors.   cheers, Seb. ... View more

The default CoS marking for VOIP is a value of 5. Depending on the platform being configured these frames will be placed in a dedicated ingress/ egress queue with a higher priority than all other (lower value traffic) traffic.   You could configure auto qos voip cisco-phone on the access ports connected to the phones, this would automatically populate the config with suitable values.   cheers, Seb.     ... View more

The default mappings should be fine and therefore all you need to do is trust the CoS markings which are coming from the phone. This will allow you to prioritse the traffic within your network, but you are correct, once it leaves the ASA it is at the mercy of your carrier network., any markings will be ignored.   Regarding the the SIP ALG setting, yes, remove the inspect sip command from the installed inspection policy on the ASA.   cheers, Seb. ... View more

Hi there Voice traffic should always be placed in a separate VLAN for the very purpose of being able to apply a high priority QoS mapping to it.   Cheers, Seb. ... View more

Why not apply an outbound ACL on the routers outside interface: ! access-list 101 permit tcp 172.16.10.0 255.255.255.0 any eq 80 access-list 101 permit tcp 172.16.10.0 255.255.255.0 any eq 443 access-list 101 permit tcp 172.16.11.0 255.255.255.0 any eq 80 access-list 101 permit tcp 172.16.11.0 255.255.255.0 any eq 443 access-list 101 deny ip 172.16.10.0 255.255.255.0 any access-list 101 deny ip 172.16.11.0 255.255.255.0 any access-list 101 permit ip 172.16.1.0 255.255.255.0 any ! int x/x desc OUTSIDE ip access-group 101 out ! 2) One you ASA arrives and is connected remove the NAT and the above ACL. The router will need a default route directed to the ISP next-hop IP, and a second route directed at the ASA outside interface for your private inside subnets. Ideally you would run a dynamic routing protocol between the two so that any new subnets added to the ASA will be known to the router.   cheers, Seb. ... View more

Hi there, Ca you run the following commands from the CLI and share the output:   packet-tracer input operaco tcp 192.168.70.2 45000 8.8.8.8 80 det packet-tracer input IoT tcp 192.168.3.4 45000 8.8.8.8 80 det cheers Seb. ... View more

Can you try attaching the ASA config again. ... View more