About Craddockc

Craddockc · ‎11-12-2018

Peter, I know im about 4 years late to the game on this post but, are there any negative design considerations when using VLAN SVI's as the L3 interfaces in OSPF vs using physical L3 interfaces? VLAN SVI's dont typically go down unless all of the physical links carrying that VLAN go down, how can this fact impact OSPF operation? Thanks.

Craddockc · ‎10-24-2018

Thank you Reza/Leo, Im assuming if I gamble and dont upgrade the ROMmon it could potentially cause some system instability if I try running the new code on the old ROMmon version?

Craddockc · ‎10-24-2018

Reza, I will give this a try and let you know. I believe with 0x2102 I need to make sure each sup has a valid "boot" statement correct?

Craddockc · ‎10-22-2018

Reza, They are definitely both running the same version IOS XE and are the exact same hardware model. I am not entirely sure about licensing because I cant see that info in the standby sup unless I do a manual failover and run the "show ver" command. Currently the active sup is running ipbase. Current Processor Information : ------------------------------ Active Location = slot 5 Current Software state = ACTIVE Uptime in current state = 2 days, 16 minutes Image Version = Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e-UNIVERSALK9-M), Version 03.02.05.SG RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2012 by Cisco Systems, Inc. Compiled Tue 31-Jul-12 12:22 by prod BOOT = bootflash:cat4500e-universalk9.SPA.03.02.05.SG.150-2.SG5.bin,1; Configuration register = 0x2101 Peer Processor Information : ------------------------------ Standby Location = slot 6 Current Software state = STANDBY COLD Uptime in current state = 2 days, 11 minutes Image Version = Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e-UNIVERSALK9-M), Version 03.02.05.SG RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2012 by Cisco Systems, Inc. Compiled Tue 31-Jul-12 12:22 by pr BOOT = bootflash:cat4500e-universalk9.SPA.03.02.05.SG.150-2.SG5.bin,1; Configuration register = 0x2101 License Store: Primary License Storage StoreIndex: 0 Feature: ipbase Version: 1.0 License Type: Permanent License State: Active, In Use License Count: Non-Counted License Priority: Medium

Craddockc · ‎10-22-2018

Dear Community, I have a 4510R+E that is utilizing 2x Sup 7E. The sups are currently running a very old IOS XE version 03.02.05.SG and ROM version 15.0(1r)SG5. When attempting to upgrade to 03.08.06E I noticed that the supervisors would not see eachother when upgrading the standby supervisor. This is most liley due to the fact that the other sup was still running the older software. After reading the release notes, the release notes for 3.8.6 state that I must upgrade the ROM to SG10 or better, however, when I pulled one of the Sups and booted the upgraded sup, it seemed to boot fine. My question is this: If the Sup seems to boot and operate fine on SG5, is there any risk to NOT upgrading the ROM to SG10? The reason I ask is because when attempting to donwload the SG10 ROM image, it said I needed an "Additional Entitlement" to do so. Thanks.

Craddockc · ‎10-22-2018

Dear Community, I have a 4510R+E that is utilizing 2x Sup 7E. When attempting to use SSO as the desired redundancy mode, I am able to configure it but the Modules state they are operating in RPR, which is obviously quite inferior to SSO. I have attempted to reboot the modules but they still are operating in RPR eventhough the configured state is SSO. Does anyone know what could cause this? Ive never seen this before. Thanks. # show red states my state = 13 -ACTIVE peer state = 4 -STANDBY COLD Mode = Duplex Unit = Primary Unit ID = 5 Redundancy Mode (Operational) = RPR Redundancy Mode (Configured) = Stateful Switchover Redundancy State = RPR Manual Swact = enabled Communications = Up client count = 63 client_notification_TMR = 240000 milliseconds keep_alive TMR = 9000 milliseconds keep_alive count = 1 keep_alive threshold = 18 RF debug mask = 0

Craddockc · ‎10-15-2018

Rahul, Thanks! In my current situation I have an ID cert by GoDaddy in TP2 but the CA Cert (also by GoDaddy) is in TP0. This is not a problem? The ASA will package both up and send those to the client automatically? Thanks.

Craddockc · ‎10-15-2018

Rahul, I genuinely appreciate your responses. I apologize as we may have been responding simultaneously. I have one more question. The way I am understanding this is that the ID Cert and the CA cert should usually be in the same TP, this way the ASA can present the entire chain to the client. Otherwise, only the ID cert will be used, which may or may not be completely trusted by the client. Is that correct?

Craddockc · ‎10-15-2018

Thanks Rahul, you are saving my bacon here!!

Craddockc · ‎10-15-2018

Rahul, Thank you for the response. So a "trustpoint" is a container that ties an ID Cert to a CA Cert, creating a "cert chain" the ASA can send to the Anyconnect client? Should the ID Cert and the CA Cert always be in the same TP? Thanks.

Craddockc · ‎10-15-2018

Gustavo, When a client using Anyconnect Mobility Client connect to the ASA, and the ASA provides an ID Cert to the Anyconnect client, how does the client (or Anyconnect software) decide that it will trust the cert provided? Does Anyconnect leverage the same "Trusted Root CA's" repository that the browser does? Thanks.

Craddockc · ‎10-15-2018

Community, I am trying to delete an identity cert in my ASA that is expired. However, when I try the ASA states that the Trustpoint "is in use" and thus is not allowing me to. Upon further investigation I found that one of the CA Certs is tied to the Trustpoint in question. I cannot see any way to change the Trustpoint. My questions are these: 1) What exactly is a Truspoint? 2) Can I just remove the CA Cert? I dont think the ASA is using the CA Certs to auth the clients that connect to the Firewall using Anyconnect is it? From what I understand, the ASA presents the ID Cert to the client machine as proof of a trusted connection. Im not exactly sure the use case for a CA cert if the firewall isnt having to trust any certs presented to it. Any help you can provide would be swell, Thanks.

Craddockc · ‎06-28-2018

Community, I have a NAT situation that I am hoping you can help me resolve. We have an internal File Transfer system with IP 10.110.80.51. This system gets NATed to a static public IP address (64.x.x.113) that we own when it is to hit the internet or hop on a VPN tunnel. We have a situation where we need this same system to communicate with another customer (via S2S VPN), but the customer requires us to use a different internal IP provided by them for this system when communicating with them across the tunnel. That is to say, we cannot use the NAT entry that currently exists for this particular situation. I was hoping I could NAT this internal system to the IP provided by the customer, but only during instances where the traffic is destined to their systems from us. I want all other traffic to get NATed to the existing 64.x.x.113 address when this system is destined anywhere else. Will this work? access-list extended CUST_NAT_ACL1 permit ip host 10.110.80.51 1.1.0.0 255.255.0.0 (first public dest subnet belonging to the customer) permit ip host 10.110.80.51 2.2.0.0 255.255.0.0 (2nd public dest subnet belonging to the customer) route-map CUST_RP1 match address CUST_NAT_ACL1 ip nat inside source static 10.110.80.51 10.201.103.169 (IP address provided by the customer) route-map CUST_RP1 ip nat inside source static 10.110.80.51 64.x.x113 (existing NAT for use in all other situations) Also, will this NAT apply only to traffic originating from us to them? or is it bidirectional? Meaning if they send traffic on the tunnel to 10.110.80.51, will the NAT rule NAT the traffic to 10.201.103.169? If so, that would be undesirable behavior. Thanks.

Craddockc · ‎05-24-2018

Community, For VLAN 134 on our network, the Nexus 9396 is the default gateway on SVI 134 (10.134.193.1). The default route is 0.0.0.0 0.0.0.0 10.100.98.4. I would like the next hop interface for default routing for certain IP's in the 134 VLAN to be 10.100.99.4 instead of 10.100.98.4, but not all IP's in that subnet. Basically I want to force all default routing for only certain IP addresses to use the 10.100.99.4 interface, while all other traffic will use the default route defined in the switch. Could I use a route map to accomplish this? If so, what would that config look like? Thanks.

Craddockc · ‎05-07-2018

Gio, Thank you very much for your replies. The VPN tunnel is back up, however my router is still showing multiple Phase 1 connections to the peer as well as one that is continually trying but failing. Is this something on the partner end that could be causing this? Multiple profiles or similar? I would like just one active Phase 1 connection. Thanks. IPv4 Crypto ISAKMP SA dst src state conn-id status 50.x.y.30 64.w.z.111 QM_IDLE 8014 ACTIVE 64.w.z.111 50.x.y.30 MM_NO_STATE 0 ACTIVE (deleted) 64.w.z.111 50.x.y.30 QM_IDLE 8013 ACTIVE dst src state conn-id status 50.x.y.30 64.w.z.111 QM_IDLE 8014 ACTIVE 64.w.z.111 50.x.y.30 MM_SA_SETUP 0 ACTIVE 64.w.z.111 50.x.y.30 QM_IDLE 8013 ACTIVE

Date Registered	‎05-30-2008 12:26 PM
Date Last Visited	‎11-12-2018 10:01 AM
Total Messages Posted	241
Total Helpful Votes Received	34

Re: Hi Data,To be concise, OSPF

Re: ROM Upgrade necessary?

Re: Supervisor Redundancy Question

Re: Supervisor Redundancy Question

ROM Upgrade necessary?

Supervisor Redundancy Question

Re: ASA Certs and Trustpoints

Re: ASA Certs and Trustpoints

Re: Multiple certificates on ASA

Re: ASA Certs and Trustpoints

Re: Multiple certificates on ASA

ASA Certs and Trustpoints

NAT IP based on Destination Address

Define next hop IP for default route us...

Re: VPN peer sending multiple Phase 1 r...