Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About MICHAEL BURNS
07-24-2019
Stats
Member since
08-26-2011
52
Posts
0
Helpful
1
Solution
07-17-2019
12:08 PM
I have a customer that is requesting to limit/shape a specific application (tcp port 12000) to 10 mbps at all times even if their total traffic has not reached the max bandwidth of 50 mbps. This is what I am thinking: ip access-list extended SNA permit tcp any any eq 12000 permit tcp any eq 12000 any ! class-map match-any SNA match access-group name SNA ! policy-map SHAPE-50MEG-VLAN500 class SNA shape average 10000000 class class-default shape peak 50000000 ! int gi0/0/0 service-policy output SHAPE-50MEG-VLAN500 ###################################### Would this work even if traffic has not reached the maximum 50mbps second? In other words, will this policy go into action even if the link is not saturated? Thanks!
... View more
Labels:
Created by
MICHAEL BURNS
in Policy and Access
in Policy and Access
11-20-2017
07:56 PM
11-20-2017
07:56 PM
Solved.
ACS sees all "do " commands as "do-exec". By changing the command to "do-exec" and adding "sh* run" it fixed the issue.
... View more
Created by
MICHAEL BURNS
in Policy and Access
in Policy and Access
11-20-2017
11:44 AM
11-20-2017
11:44 AM
I am having an issue allowing "do" show commands in the command set.
Specifically I want users to be able to issue:
"do show run interface *"
I cannot get the "do" portion to work. Would I have "do show" in the command portion? Or would I just have "do" in the command portion and "show run interface *" in the argument portion?
***Edit***
I found in ACS logs that ACS sees it come across as "do-exec" instead of just "do". Using that, I have "do-exec" in the command field and "sh* run" in the argument field. All good now!
... View more
- Tags:
- acs
Labels:
02-09-2016
06:26 PM
My company has a strict policy against efficient use of CLI : )
Thanks, Phil. That was a good catch!
... View more
02-09-2016
01:41 PM
I am working on implementing QoS on our WAN router and want to run this by the community to see if I am doing what I think I am doing. Here are the facts.
Traffic is being classified and marked by Riverbed Steelhead
WAN link is a 622 Mb OC-12
I want to guarantee 10% of link for EF traffic
I have changed maximum-reserved-bandwidth to 100%
I have divided up the other 4 classes as follows: NORMAL (Includes all RFC 1918 as source and destination) 50% INTERACTIVE 10% BUSINESS CRITIAL 20% LOW_PRIORITY 10%
Here's my proposed config:
class-map match-any REALTIME match dscp ef class-map match-any INTERACTIVE match dscp af41 class-map match-any BUSINESS_CRITICAL match dscp af31 class-map match-any NORMAL match dscp af21 class-map match-any LOW_PRIORITY match dscp af11 ! policy-map EGRESS class NORMAL bandwidth percent 50 class INTERACTIVE bandwidth percent 10 class BUSINESS_CRITICAL bandwidth percent 20 class LOW_PRIORITY bandwidth percent 10 ! policy-map qos-voice class REALTIME priority 62200 class class-default fair-queue random-detect dscp-based service-policy EGRESS !
Any suggestions? Any possible issues?
... View more
Labels:
08-18-2014
01:13 PM
Any documentation on ACL limit on a 3925? I'm looking to createa 48000 line ACL and want to know if it will handle it. Any info is appreciated.
... View more
Labels:
Created by
MICHAEL BURNS
in Other Collaboration Subjects
in Other Collaboration Subjects
03-04-2014
01:08 PM
03-04-2014
01:08 PM
I just bought 2 new 4310G DMP's and when they come up, they show as up for a short period of time and then show down. I ensured that the passwords are the same on the DMP's and the DMM. Is there an compatibility issue with the firmware, by chance? I haven't been able to find anything, but that is my last guess.
... View more
Labels:
Change Which Controller Is Primary and ...
in Wireless and Mobility
01-17-2014
07:23 AM
01-17-2014
07:23 AM
Oh, OK. Let me see if I understand this correctly. In order to configure the pair as AP SSO, it has to be like this: Primary (Valid Permanent AP Base Count) Secondary (At Least a 50 AP Base Count) However, even if the secondary has the 50 AP Base count license, it is going to inherit the license of the primary controller. So since I have a 12 AP Permanant license on my primary, the secondary will show it is licensed for 12 AP's when it takes over, correct? The only way to increase this would be to buy more licenses for my Primary Controller if I understand correctly.
... View more
Change Which Controller Is Primary and ...
in Wireless and Mobility
01-17-2014
06:33 AM
01-17-2014
06:33 AM
Scott Fella wrote: Just to add... If you have licensed WLC's, since the initially had 12 ap license, it's not the HA Sku. To have the ability to do HA AP SSO or N+1, your backup, let's call it you HA pair, needs a minimum 50 AP license. This allows you to only have to buy license for the primary WLC and not for both. Depending on your budget and what you really want to do, you have 3 choices of redundancy: ? Both WLC have licenses and you can balance the AP load.. Half on one and half on the other for example ? HA AP SSO which you have to have 50 AP license in the backup HA WLC ? N+1 which you have to have 50 AP license on the backup HA WLC Sent from Cisco Technical Support iPhone App The second and third option appear to be the same... typo?
... View more
Created by
MICHAEL BURNS
in VPN and AnyConnect
in VPN and AnyConnect
01-08-2014
12:07 PM
01-08-2014
12:07 PM
Thank you, Jouni. That is the info I needed! I am going to lab it up this week. I appreciate your help!
... View more
01-02-2014
10:19 AM
Currently, we have a number of VPN's set up with various clients. We are NAT'ing their range to a /24 in our network to keep routing simple, but we are looking to Source NAT our resources due to security concerns. This is an example of a current VPN we have configured: crypto map outside_map 5 match address SAMPLE_cryptomap crypto map outside_map 5 set peer 99.99.99.99 crypto map outside_map 5 set ikev1 transform-set ESP-3DES-SHA ESP-3DES-MD5 crypto map outside_map 5 set reverse-route access-list SAMPLE_cryptomap extended permit ip object-group APP_CLIENT_Hosts object-group CLIENT_Hosts nat (inside,outside) source static APP_CLIENT_Hosts APP_CLIENT_Hosts destination static CLIENT_Host_1_NAT CLIENT_Host_1 no-proxy-arp route-lookup nat (inside,outside) source static APP_CLIENT_Hosts APP_CLIENT_Hosts destination static CLIENT_Host_2_NAT CLIENT_Host_2 no-proxy-arp route-lookup nat (inside,outside) source static APP_CLIENT_Hosts APP_CLIENT_Hosts destination static CLIENT_Host_3_NAT CLIENT_Host_3 no-proxy-arp route-lookup object-group network APP_CLIENT_Hosts network-object object SITE1_APP_JCAPS_Dev_VIP network-object object SITE1_APP_JCAPS_Prod_VIP network-object object SITE2_APP_JCAPS_Dev_Host network-object object SITE2_APP_JCAPS_Prod_VIP network-object object SITE1_APP_PACS_Primary object network SITE1_APP_JCAPS_Dev_VIP host 10.200.125.32 object network SITE1_APP_JCAPS_Prod_VIP host 10.200.120.32 object network SITE2_APP_JCAPS_Dev_Host host 10.30.15.30 object network SITE2_APP_JCAPS_Prod_VIP host 10.30.10.32 object network SITE1_APP_PACS_Primary host 10.200.10.75 object network CLIENT_Host_1 network-object host 192.168.15.100 object network CLIENT_Host_2 network-object host 192.168.15.130 object network CLIENT_Host_3 network-object host 192.168.15.15 object network CLIENT_Host_1_NAT network-object host 10.200.192.31 object network CLIENT_Host_2_NAT network-object host 10.200.192.32 object network CLIENT_Host_3_NAT network-object host 10.200.192.33 My question revolves around the configuration of the Source NAT. If I understand it correctly, I am going to have to configure 3 NAT statements per Source NAT since there are three different destinations that are being NAT'ed. I believe I would need to add this: object network SITE1_APP_JCAPS_Dev_VIP_NAT host 88.88.88.81 object network SITE1_APP_JCAPS_Prod_VIP_NAT host 88.88.88.82 object network SITE2_APP_JCAPS_Dev_Host_NAT host 88.88.88.83 object network SITE2_APP_JCAPS_Prod_VIP_NAT host 88.88.88.84 object network SITE1_APP_PACS_Primary_NAT host 88.88.88.85 nat (inside,outside) source static SITE1_APP_JCAPS_Dev_VIP SITE1_APP_JCAPS_Dev_VIP_NAT destination static CLIENT_Host_1_NAT CLIENT_Host_1 no-proxy-arp route-lookup nat (inside,outside) source static SITE1_APP_JCAPS_Dev_VIP SITE1_APP_JCAPS_Dev_VIP_NAT destination static CLIENT_Host_2_NAT CLIENT_Host_2 no-proxy-arp route-lookup nat (inside,outside) source static SITE1_APP_JCAPS_Dev_VIP SITE1_APP_JCAPS_Dev_VIP_NAT destination static CLIENT_Host_3_NAT CLIENT_Host_3 no-proxy-arp route-lookup nat (inside,outside) source static SITE1_APP_JCAPS_Prod_VIP SITE1_APP_JCAPS_Prod_VIP_NAT destination static CLIENT_Host_1_NAT CLIENT_Host_1 no-proxy-arp route-lookup nat (inside,outside) source static SITE1_APP_JCAPS_Prod_VIP SITE1_APP_JCAPS_Prod_VIP_NAT destination static CLIENT_Host_2_NAT CLIENT_Host_2 no-proxy-arp route-lookup nat (inside,outside) source static SITE1_APP_JCAPS_Prod_VIP SITE1_APP_JCAPS_Prod_VIP_NAT destination static CLIENT_Host_3_NAT CLIENT_Host_3 no-proxy-arp route-lookup nat (inside,outside) source static SITE2_APP_JCAPS_Dev_Host SITE2_APP_JCAPS_Dev_Host_NAT destination static CLIENT_Host_1_NAT CLIENT_Host_1 no-proxy-arp route-lookup nat (inside,outside) source static SITE2_APP_JCAPS_Dev_Host SITE2_APP_JCAPS_Dev_Host_NAT destination static CLIENT_Host_2_NAT CLIENT_Host_2 no-proxy-arp route-lookup nat (inside,outside) source static SITE2_APP_JCAPS_Dev_Host SITE2_APP_JCAPS_Dev_Host_NAT destination static CLIENT_Host_3_NAT CLIENT_Host_3 no-proxy-arp route-lookup nat (inside,outside) source static SITE2_APP_JCAPS_Prod_VIP SITE2_APP_JCAPS_Prod_VIP_NAT destination static CLIENT_Host_1_NAT CLIENT_Host_1 no-proxy-arp route-lookup nat (inside,outside) source static SITE2_APP_JCAPS_Prod_VIP SITE2_APP_JCAPS_Prod_VIP_NAT destination static CLIENT_Host_2_NAT CLIENT_Host_2 no-proxy-arp route-lookup nat (inside,outside) source static SITE2_APP_JCAPS_Prod_VIP SITE2_APP_JCAPS_Prod_VIP_NAT destination static CLIENT_Host_3_NAT CLIENT_Host_3 no-proxy-arp route-lookup nat (inside,outside) source static SITE1_APP_PACS_Primary SITE1_APP_PACS_Primary_NAT destination static CLIENT_Host_1_NAT CLIENT_Host_1 no-proxy-arp route-lookup nat (inside,outside) source static SITE1_APP_PACS_Primary SITE1_APP_PACS_Primary_NAT destination static CLIENT_Host_2_NAT CLIENT_Host_2 no-proxy-arp route-lookup nat (inside,outside) source static SITE1_APP_PACS_Primary SITE1_APP_PACS_Primary_NAT destination static CLIENT_Host_3_NAT CLIENT_Host_3 no-proxy-arp route-lookup Is that correct, or is there an easier way to do it without having to add all the NAT statements? Also,would any changes need to be made on the access-list?
... View more
Labels:
Created by
MICHAEL BURNS
in Storage Networking
in Storage Networking
12-13-2013
01:49 PM
12-13-2013
01:49 PM
We are deploying Solarwinds and would like some tips on what would be useful to monitor on MDS switches. Of course, the normal port utilization, cpu, interface counters are already set up, but thought I would check to see if anyone has any suggestions on any other OID's I should look into. Thanks!
... View more
- Tags:
- mds
Labels:
Created by
MICHAEL BURNS
in VPN and AnyConnect
in VPN and AnyConnect
12-04-2013
09:15 AM
12-04-2013
09:15 AM
Thanks, Jouni! I had it backwards in my feeble head. I think this will work perfectly.
... View more
Created by
MICHAEL BURNS
in VPN and AnyConnect
in VPN and AnyConnect
12-04-2013
08:59 AM
12-04-2013
08:59 AM
Thanks, Jouni! So, if I understand correctly, I would accomplish that by making these changes: object network THEIR_HOST_1 network-object host 192.168.15.100 object network THEIR_HOST_2 network-object host 192.168.15.130 object network THEIR_HOST_3 network-object host 192.168.15.15 object network THEIR_HOST_1_NAT network-object host 10.200.192.31 object network THEIR_HOST_2_NAT network-object host 10.200.192.32 object network THEIR_HOSTt_3_NAT network-object host 10.200.192.33 nat (inside,outside) source static OUR_HOSTS OUR_HOSTS destination static THEIR_HOST_1 THEIR_HOST_1_NAT no-proxy-arp route-lookup nat (inside,outside) source static OUR_HOSTS OUR_HOSTS destination static THEIR_HOST_2 THEIR_HOST_2_NAT no-proxy-arp route-lookup nat (inside,outside) source static OUR_HOSTS OUR_HOSTS destination static THEIR_HOST_3 THEIR_HOST_3_NAT no-proxy-arp route-lookup Please let me know if I am on the right track. Thanks!
... View more
Created by
MICHAEL BURNS
in VPN and AnyConnect
in VPN and AnyConnect
12-03-2013
01:33 PM
12-03-2013
01:33 PM
I am working on a project to simplify our routing by NAT'ing the IP's of our S2S VPN clients. Currently, the we have a bunch of routes pointing to various destinations which are created by the S2S VPN's. I would like to NAT all of those destinations to IP's within a single subnet, but have a question regarding the configuration. As you can see, we aren't currently NAT'ing anything: *************************************************************************************************************************************************************** nat (inside,outside) source static OUR_HOSTS OUR_HOSTS destination static THEIR_HOSTS THEIR_HOSTS no-proxy-arp route-lookup object-group network OUR_HOSTS network-object object VIP1 network-object object VIP2 object network VIP1 host 10.200.125.32 object network VIP2 host 10.200.120.32 object-group network THEIR_HOSTS network-object host 192.168.15.100 network-object host 192.168.15.130 network-object host 192.168.15.15 ******************************************************************************************************************************************************************** What I would like to do is NAT the THEIR_HOSTS to a 10.200.192.x/24 address. Can I NAT those to a single address and do NAT overload, or does there have to be an address for each of those 3 hosts? I'm fine either way. Whichever would be easier to do, please point me in the right direction. Thanks!
... View more
- Tags:
- nat
Labels:
07-17-2019
I have a customer that is requesting to limit/shape a specific
application (tcp port 12000) to 10 mb...
11-20-2017
Solved. ACS sees all "do " commands as "do-exec". By changing the
command to "do-exec" and adding "s...
11-20-2017
I am having an issue allowing "do" show commands in the command set.
Specifically I want users to be...
02-09-2016
My company has a strict policy against efficient use of CLI : ) Thanks,
Phil. That was a good catch!
02-09-2016
I am working on implementing QoS on our WAN router and want to run this
by the community to see if I...
08-18-2014
Any documentation on ACL limit on a 3925? I'm looking to createa 48000
line ACL and want to know if ...
Created by
MICHAEL BURNS
in Other Collaboration Subjects
03-04-2014
03-04-2014
I just bought 2 new 4310G DMP's and when they come up, they show as up
for a short period of time an...
Created by
MICHAEL BURNS
in Wireless and Mobility
01-17-2014
01-17-2014
Oh, OK. Let me see if I understand this correctly.In order to configure
the pair as AP SSO, it has t...
Created by
MICHAEL BURNS
in Wireless and Mobility
01-17-2014
01-17-2014
Scott Fella wrote:Just to add... If you have licensed WLC's, since the
initially had 12 ap license, ...
01-08-2014
Thank you, Jouni. That is the info I needed! I am going to lab it up
this week. I appreciate your he...
01-02-2014
Currently, we have a number of VPN's set up with various clients. We are
NAT'ing their range to a /2...
12-13-2013
We are deploying Solarwinds and would like some tips on what would be
useful to monitor on MDS switc...
12-04-2013
Thanks, Jouni! So, if I understand correctly, I would accomplish that by
making these changes: objec...
Public Statistics
| Date Registered | 08-26-2011 07:52 AM |
| Date Last Visited | 07-24-2019 02:49 AM |
| Total Messages Posted | 52 |
.jpg "VIP Engager"){kind=icon}
