Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About paul driver
Online
paul driver
.jpg){kind=icon}
VIP Advisor
Originated from a system solution background, mainly working with active directory infrastructure NT4,2K,2K3, then fell into networking and started to support manufacturing LAN/MAN campus networks.
Currently working for AT&T in project engineering supporting Healthcare and Civil nuclear accounts.
Awards
5
2
Recent Badges
Stats
Member since
06-12-2007
6325
Posts
5297
Helpful
567
Solutions
08-22-2019
05:24 AM
Hello
So the 10.10.10.11-12 are outside your lan network and visibility into your network is for these hosts is to hit 2.2.2.2 correct hosts >10.10.10.11-12 <--> 2.2.2.2 <nat lan>192.168.1.1 -10 So if the above is correct and the example i provided previously traffic from those two host should load balance to your lan host in the nat pool
... View more
08-21-2019
12:08 PM
Hello
Yes it is indeed applicable to to have ASA HA, to dom this suggest to pick a spare interface (fastest) on each asa and use that as the fail-over link between the two ASA. Basically all you need to do it setup the fail-over on the priamry asa and when you ready attached the secondary asa initiate failover. Each interface on the primary will be the same on the secondary.
ASA1 int x/x nameif outside ip address 1.1.1.1 255.255.255.0 secondary 1.1.1.2
int x.x nameif inside ip address 10.10.10.1 255.255.255.0 secondary 10.10.10.2
int x.x nameif DMZ ip address 11.11.11.1 255.255.255.0 secondary 11.11.11.2
.
int gig 1/1 (Failover link) no shut exit
failover lan unit primary failover lan interface Failover gig1/1
failover interface ip Failover 172.16.1,1 255.255.255.0 standby 172.16.1.2 failover key ASAFO
ASA2
Just make sure all interfaces are activated on secondary ASA that relate to the primary ASA ( these should be the exact same interfaces as above but they DONT need to be configured just enabled)
int x/x no shut exit....... int gig 1/1 (Failover link) no shut exit
(only config required on ASA2) failover lan unit secondary failover lan interface Failover gig1/1
failover interface ip Failover 172.16.1,1 255.255.255.0 standby 172.16.1.2 failover key ASAFO
Connect the two asa's together and instate the HA replication (apply to both fw's) ASA1/2 conf t failover
Once initiated then the ASA's will replicate with each other
show failover
prompt hostname priority state -- <--this will show you what FW your currency connected to in the future Optionally you can also have a stateful link between the two fw's but youll require an additional spare interface
ASA1/2 int gig1/2 no shut exit failover link stateful-FO gig1/2 failover interface ip stateful-FO 172.16.2.1 255.255.255.252 standby 172.16.2.2
... View more
08-21-2019
11:15 AM
Hello
@thatsdanish25 wrote:
Hello,
I have a doubt while doing Destination NAT or Hide NAT for Multiple IPS.
Suppose - 192.168.1.1-10 --> 10.10.10.11 & 10.10.10.12 on port 80
I want 192.168.1.1-10 to hit 2.2.2.2 and that will get translated to 10.10.10.11 & 10.10.10.12
My Question is can i use a single NAT ip for both these destinations ? Suppose one of the IPs makes a connection to 10.10.10.11 with NAT IP 2.2.2.2 , will another connection be successful with only one NAT IP and same port ?
Sounds like you may need to LB your nat but to clarify 192.168.1.1 -10 are you inside local addresses (lan) 10.10.10.11-12 are you inside global addresses (wan) 2.2.2.2 is a public ip address that you want to reach and is reachable from 10.10.10.11-12 Example of possible NAT LAB access-list 100 permit tcp host 10.10.10.11 any eq 80 access-list 100 permit tcp host 10.10.10.12 any eq 80 ip nat pool LB 192.168.1,1 192.168.1.10 prefix-length 24 type rotary
ip nat inside destination list 100 pool LB
... View more
08-19-2019
01:01 AM
Hello
@hadi riyahiyan wrote: tnx it works, webServer is accessed from both ISP1 and IPS2 but if IPS1 is not accessible, the Webserver cannot ping 3.3.3.3 !!!
Sounds like you need some monitoring on your routing, Below is a example of using default routing towards your isp's?
ip sla 1 icmp-echo <iSP1> source-ip <isp facing interlace ip> ip sla schedule 1 life forever start-time now
track 10 ip sla 1
ip route 0.0.0.0 0.0.0.0 <isp1> name Primary_ISP track 10 ip route 0.0.0.0 0.0.0.0 <isp2> name Secondary_ISP 200
... View more
08-15-2019
02:03 AM
Hello
Could be worth try deleting the vlan.dat from flash , reloading the switches and testing again, thats if you haven't already done it.?
... View more
08-15-2019
01:48 AM
Hello
Another option would possible to using NVI NAT instead as its symmetrical (no inside/outside regards nat order of operation) and performs routing lookup twice, it should work with you internal hosts being able to access inside web servers via it external ip.
in vlanl ip nat inside ip nat enable int dailer 1 ip nat outside ip nat enable
ip nat inside source list NAT interface Dialer1 overload ip nat inside destination list 100 pool UniFi-WiFi ip nat inside destination list 101 pool Pi-Hole ip nat inside destination list 102 pool 3cx
... View more
08-15-2019
01:26 AM
Hello
I don't see any dual connectivity in your topology so not so sure why you have stated a nat redundancy?
Can you post the config of the ASR rtr please?
... View more
08-12-2019
03:31 PM
Hello R egards your ping my understanding the primary interface is always used as source even when you have secondary addressing assign to the same interface. Just for clarity - you really don’t need these static routes as they are captured by the default static route
No ip route 10.0.0.0 255.255.255.0 192.168.34.245 No ip route 10.40.0.0 255.255.0.0 192.168.34.245 No ip route 10.40.10.0 255.255.254.0 192.168.34.245 No ip route 10.75.254.0 255.255.255.0 192.168.34.245 No ip route 10.75.255.0 255.255.255.0 192.168.34.245 No ip route 172.24.16.0 255.255.252.0 192.168.34.245 No ip route 172.24.20.0 255.255.255.0 192.168.34.245 Lastly could you try the following: no access-list 110 permit ip 10.99.99.0 0.0.0.255 192.168.56.0 0.0.0.255 no route-map PBR access-list 110 permit ip 192.168.34.0 0.0.0.255 192.168.56.0 0.0.0.255 route-map PBR_testing deny 10 match ip address 110 route-map PBR_testing permit 99 set ip next-hop 192.168.34.245
... View more
08-12-2019
07:23 AM
Hello
Your ipsla config is pointing to a internet address which may be still be seen as accessible by your router so your sla wont initiate and failover correctly, try and monitor an ip address that is closer to the dialer 1 interface. Another alternative is implement dailer-watch setup but as your using static routes no so sure it would work accordingly
... View more
08-12-2019
02:03 AM
Hello
Glad you fixed this problem just would like to point out for future ref.
interface GigabitEthernet2/0 <---- by default this would be your native vlan 1 ip address 1.0.0.1 255.255.255.0 ! interface GigabitEthernet2/0.1 encapsulation dot1Q 1 native bridge-group 1 interface GigabitEthernet2/0.10 encapsulation dot1Q 10 bridge-group 10<----- IRB isn't required interface GigabitEthernet2/0.20 encapsulation dot1Q 20 bridge-group 20<----- IRB isn't required interface GigabitEthernet2/0.30 encapsulation dot1Q 30 bridge-group 30<----- IRB isn't required
... View more
08-10-2019
11:09 AM
@luis_cordova wrote:
but it must be applied in the subinterface.
Indeed that's if the router is performing the inter-vlan routing otherwise it would be the L3 switch
... View more
08-10-2019
06:45 AM
@luis_cordova
You acl will negate access to the whole 10.1.6.0/24 subnet for https not just a specific host
... View more
08-09-2019
11:47 PM
Hello
Try and apply the acl as close to the source as possible in this case apply it o the svi of vlan 101 on the switch if that is performing the intervlan-routing
access-list 100 deny tcp host 10.1.6.4 host 10.10.10.1 eq 443 access-list 100 deny tcp host 10.1.6.4 host 10.10.10.1 eq 80 access-list 100 permt ip any any
int vlan 101 ip access-group 100 in
... View more
08-22-2019
Hello So the 10.10.10.11-12 are outside your lan network and visibility
into your network is for the...
08-21-2019
Hello Yes it is indeed applicable to to have ASA HA, to dom this suggest
to pick a spare interface (...
08-21-2019
Hello @thatsdanish25 wrote: Hello, I have a doubt while doing
Destination NAT or Hide NAT for Multip...
Created by
paul driver
in Routing
08-19-2019
08-19-2019
Hello @hadi riyahiyan wrote:tnx it works, webServer is accessed from
both ISP1 and IPS2 but if IPS1 ...
08-15-2019
Hello Could be worth try deleting the vlan.dat from flash , reloading
the switches and testing again...
08-15-2019
Hello Another option would possible to using NVI NAT instead as its
symmetrical (no inside/outside r...
08-15-2019
Hello I don't see any dual connectivity in your topology so not so sure
why you have stated a nat re...
Created by
paul driver
in Routing
08-12-2019
08-12-2019
HelloRegards your ping my understanding the primary interface is always
used as source even when you...
08-12-2019
Hello Your ipsla config is pointing to a internet address which may be
still be seen as accessible b...
Created by
paul driver
in Switching
08-12-2019
08-12-2019
Hello Glad you fixed this problem just would like to point out for
future ref. interface GigabitEthe...
Created by
paul driver
in Routing
08-12-2019
08-12-2019
Hello Looks like ios version incompatibility problem
08-10-2019
@luis_cordova wrote: but it must be applied in the subinterface. Indeed
that's if the router is perf...
08-10-2019
@luis_cordova You acl will negate access to the whole 10.1.6.0/24 subnet
for https not just a specif...
Public Statistics
| Date Registered | 06-12-2007 12:44 AM |
| Date Last Visited | 08-22-2019 05:07 AM |
| Total Messages Posted | 6,325 |
| Total Helpful Votes Received | 5297 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 35 | |
| 37 | |
| 20 | |
| 5 | |
| 10 |
.jpg "Hall of Fame Guru"){kind=icon}
Helpful Votes From
Awards
Cisco Designated VIPs
2018 LAN WAN
Cisco Designated VIPs
2016 LAN WAN
Cisco Designated VIPs
2015 LAN WAN
Cisco Designated VIPs
2014 LAN
Cisco Designated VIPs
2019 Switching, Routing
Community Spotlight Award
Mobile App Contributor March 2013
Community Spotlight Award
Members Choice June 2013
