Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Jeff Van Houten
09-07-2018
Jeff Van Houten
Contributor
Awards
1
Spotlight Awards Mobile App Contributor April 2012
Recent Badges
Stats
Member since
12-05-2011
627
Posts
152
Helpful
52
Solutions
11-03-2016
11:46 AM
C2911 running 15.4(3)M6a
Router has a DMVPN connection to a hub and NAT overload (PAT) using a route-map. Problem is that certain packets are showing in the log as being denied by the ACL used by the route-map. Traffic over the DMVPN and general Internet access are good. Configuration as follows:
interface Tunnel0 bandwidth 10000 ip address 172.29.99.22 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication <snip> ip nhrp map 172.29.99.1 <snip> ip nhrp map multicast <snip> ip nhrp network-id <snip> ip nhrp holdtime 600 ip nhrp nhs 172.29.99.1 ip tcp adjust-mss 1360 qos pre-classify tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key <snip> tunnel protection ipsec profile <snip>
interface GigabitEthernet0/0 description TO CHARTER CABLE MODEM ip address dhcp ip access-group INTERNET-IN in ip nat outside ip inspect BR-FW out ip virtual-reassembly in duplex auto speed auto no cdp enable no mop enabled
ip nat inside source route-map cc-term interface GigabitEthernet0/0 overload
route-map cc-term permit 10 match ip address 195 set ip next-hop dynamic dhcp
access-list 195 permit ip host 10.22.40.250 any access-list 195 permit ip host 10.22.50.150 any access-list 195 deny ip any any log
Log shows up as:
%SEC-6-IPACCESSLOGNP: list 195 denied 50 <GI0/0 Address> -> <HUB DMVPN EXTERNAL ADDRESS>, 12 packets
%SEC-6-IPACCESSLOGP: list 195 denied udp <GI0/0 Address>(0) -> <HUB DMVPN EXTERNAL ADDRESS>(0), 16 packets
First log is ESP (protocol 50) and the second log is, I believe, ISAKMP (UDP 500). These logs show up in about 4 minute intervals.
Diagnostic:
#sh route-map route-map cc-term, permit, sequence 10 Match clauses: ip address (access-lists): 195 Set clauses: ip next-hop dynamic dhcp - current value is <GI0/0 Next-Hop> Policy routing matches: 0 packets, 0 bytes
#sh ip nat transl Pro Inside globalInside local Outside local Outside global tcp <GI0/0 Address>:36680 10.22.50.150:36680 204.141.57.100:443 204.141.57.100:443 tcp <GI0/0 Address>:36681 10.22.50.150:36681 204.141.57.101:443 204.141.57.101:443 tcp <GI0/0 Address>:36682 10.22.50.150:36682 12.149.218.73:443 12.149.218.73:443
... View more
Labels:
Created by
Jeff Van Houten
in Network Management
in Network Management
04-24-2016
11:46 AM
04-24-2016
11:46 AM
is it possible to have EEM read from a file on an scp server, then load each line of that file into an acl? Basically I want eem to update an acl periodically. I know I can use eem to remove the acl from the interface and add the static parts of the acl back, then add the acl back to the interface. What I need is a loop to read the remote file and add those addresses to the acl.
... View more
Labels:
Created by
Jeff Van Houten
in IP Telephony and Phones
in IP Telephony and Phones
11-17-2014
06:51 AM
11-17-2014
06:51 AM
In my experience, on a router acting as an H.323 gateway and using T.38, you need to have the following command in the config. ip tcp path-mtu-discovery Doesn't hurt to try.
... View more
06-08-2014
08:57 PM
DMVPN requires routers at all locations. Only the central site requires a fixed IP address.
... View more
06-07-2014
08:10 PM
Whether or not you need the aim card is largely a matter of the bandwidth you need to support and the number of users. For 5 simultaneous users at anything more than a few megabits I would definitely add the card. as for the version, I believe you need advanced security or enterprise. There may be others but I usually stick with advanced security.
... View more
06-07-2014
07:17 PM
In addition to Leo's answer, if you are running an image capable, you will want to add no ip http secure-server.
... View more
05-26-2014
05:06 PM
Do you need 65,000 ip addresses on your local LAN? Subdivide the network with smaller subnets and devote one of those smaller subnets for the remote access VPN.
... View more
05-24-2014
10:26 PM
Dhcp clients send broadcasts. If all dhcp servers are in the same vlan, whichever answers first will supply the address. You can consider creating separate Vlans for wired and wireless or you could shrink the available addresses that each server can supply so that are no overlaps.
... View more
04-26-2014
07:49 AM
Has it ever worked? The link below says that card should not work in a 2620. http://www.cisco.com/c/en/us/products/collateral/routers/1700-series-modular-access-routers/product_data_sheet09186a00801a9184.html
... View more
04-12-2014
06:52 AM
For an enterprise with multiple sites, many MPLS providers require the CE routers run BGP to exchange routes with the PE providers so a mesh network can be created.
... View more
04-03-2014
09:01 PM
What address are you trying to ssh into? I was always told not to put an IP address on an interface at the "root" level if you were going to use sub-interfaces. Other than not being able to hit the vty ports from the internal network, is this router working correctly?
... View more
04-03-2014
08:44 PM
You can define an internal dns server for the clients to use when they connect.
... View more
04-03-2014
08:23 PM
If the card is a wic1-dsu, the controller will not show up separately. Use sh int s0/3/0 servi ice-module for the alarms, linecoding and framing defaults.
... View more
Created by
Jeff Van Houten
in TelePresence and Video Infrastructure
09-29-2017
09-29-2017
We have an unusual issue. We are using CUCM 10.5. We have 3 SX20s
registered to CUCM, a C40, an SX10...
11-03-2016
C2911 running 15.4(3)M6a Router has a DMVPN connection to a hub and NAT
overload (PAT) using a route...
04-24-2016
is it possible to have EEM read from a file on an scp server, then load
each line of that file into ...
Created by
Jeff Van Houten
in Unified Communications Infrastructure
02-16-2016
02-16-2016
In UCCX 10.6, is there a way to download a previously uploaded file from
the "Document Management" m...
11-17-2014
In my experience, on a router acting as an H.323 gateway and using T.38,
you need to have the follow...
06-08-2014
DMVPN requires routers at all locations. Only the central site requires
a fixed IP address.
06-07-2014
Whether or not you need the aim card is largely a matter of the
bandwidth you need to support and th...
06-07-2014
In addition to Leo's answer, if you are running an image capable, you
will want to add no ip http se...
05-26-2014
Do you need 65,000 ip addresses on your local LAN? Subdivide the network
with smaller subnets and de...
05-24-2014
Dhcp clients send broadcasts. If all dhcp servers are in the same vlan,
whichever answers first will...
04-26-2014
Has it ever worked? The link below says that card should not work in a
2620.http://www.cisco.com/c/e...
04-12-2014
For an enterprise with multiple sites, many MPLS providers require the
CE routers run BGP to exchang...
Public Statistics
| Date Registered | 12-05-2011 06:52 PM |
| Date Last Visited | 09-07-2018 12:03 AM |
| Total Messages Posted | 627 |
| Total Helpful Votes Received | 152 |
Helpful Votes From
Awards
Community Spotlight Award
Mobile App Contributor April 2012
