Hello Is the ntp server reachable? any access-list negating ip or port communication? any ntp authentication applied such a authentication/trusted key ... View more

Hello Use ospf costing on the least preferred links for resiliency ... View more

Hello Star Excellent news  - can you mark the post as solved and rate Ricks support please ... View more

Hello Just like to add.. PBR logic differs on what command you apply for it. set default ip next hop/ default interface will ONLY policy route your acl traffic if there isn't an active entry in the route table, meaning it checks the route table prior to decided weather to policy route or not, So if the router sees an entry in the route table then policy routing isnt activated and so the PBR acl traffic is routed normally. set ip next hop/interface -  will NOT check the route table and will attempt to policy route straight away.   As rick stated - please post your configuration so it can be reviewed. ... View more

Hello The OP was @mikejgalovich but it seems @Star Sulaiman also posted - so are both of you experiencing the same issue ... View more

Hello   @Chris_78 wrote:   I hope that doesn't sound too confusing ..    It does really as as you say , if either FW fails looking at your topology, how do the two site connect, you dont have any other physical connection between those sites or do you? ... View more

Congratulations Peter Very well deserved indeed. ... View more

Hello have a look at this previous post https://community.cisco.com/t5/routing/nat-/td-p/2475807   ... View more

Hello not so sure I understand this- you are saying that you receive an external prefix and then your ce rtr  re-advertises it? ... View more

Hello @TRACY HARTMANN wrote: Sorry this won't work since I don't want all my traffic to go that next-hop.  I need just traffic I don't have a route to so my gateway of last resort.   What was suggested will send all my traffic to that hop.      For example I have ip address 10.20.0.1 and I have many routes to get anywhere but if there is not route I want my gateway of last resort for this ip address to go to a different gateway of last resort then what is configured by default. PBR will do this for you - what i am saying is if you don't have any verification on this additional gateway then any traffic PBR'd towards this gateway will be blackholed if that gateway is lost, now if that's acceptable then @Georg Pauwen example would be applicable.       ... View more

Hello FYI a web server does have maximum connection value but I’m not sot sure what that would be and it any case you say external to your network connection to this webserver is okay and reachable    So If all these internal connections go through a fw that then you could look at the possibility that your maxing out on your FW license user limit, but this will drop all access not just towards a webserver.   I get the impression this is a relativity new issue? ... View more

Hello Domain-less nat (NVI) should be able to accommodate this, As the nat order differs from domain based nat in that NVI nat performs two route lookups before and after nat translation, thus internal hosts should be able to reach their own internal web server via its local destination natted address.   Example: int x/x description wan ip address 1.1.1.1 255.255.255.0 ip nat enable int x/x description Lan ip address 192.168.1.1 255.255.255.0 ip nat enable access-list 1 deny host 192.168.1.10 access-list permit 192.168.1.0 0.0.0.255 ip nat source static tcp 192.168.1.10 443 1.1.1.10 443 ip nat source list 1 interface (wan) ... View more

Hello Your topology attached doesn't replicate the setup you stated? @engahmad8 wrote: I have one router connect to ISP and I have 2 L3 devices   I need to connect this router to it   IP subnet between this 2 device should be same   however, need  to configure two interface to connect both L3 devices  I need your help with out using switch between router and L3 devices      ... View more