Hello from my phone your M/C config looks fine can you confirm you have reachability to all networks as I did notice you have eigrp running and by default this protocol is class full in design so you may need to disable auto summarisation otherwise any non classfull subnets may not be advertised correctly router eigrp xx no auto-summary ... View more

Hello Yes - it will send it to both the DR/BDR then the DR will send an acknowledgment back to the router that originated the lsa and then flood that lsa to all routers including the BDR. ... View more

Hello @Zxanthar98 wrote: Hello, I hope everyone is doing well in quarantine. I had a super annoying question about route maps and how they worked with ACL's. I get the whole idea behind them I think, but one thing I was really curious about was, if there is a route map seq that says deny but the ACL it is referencing permits the prefix, what happens to the traffic? Thank you!!  This would depend on the whole route-map the route-map logic would deny the ace entry being used in the route-map and proceed to the next stanza if there is one if not the default implicit deny would be used      ... View more

Hello Two things wth you lastest configuration-   router bgp xx neighbor 1.1.1.2 soft-reconfiguration inbound <---I would suggest if you rtr has the capability remove this and utilize route refresh instead, it would save on router processing the adj-rib-in table for ingress prefixes especially if your excepting a full internet table ip as-path access-list 1 permit ^$ route-map AS-2222-INCOMING permit 10 match as-path 1 < this regex value is matching on any prefixes that doesn’t have a asn value attached to it, it’s usually used to only advertised locally originated routes towards ypur ISP but you have it to filter ingress on routes advertised from your ISP, Would suggest again to remove this as-path filter and just have a catch all statement for local preferance on all incoming routes from your isp   ... View more

Hello soukh1@hotmail.com wrote: I have windows server located in the school  on my privet lan and i want to connect this server from my house via remote desktop function  the External port number is 10015 its alredy opend inde router internal port 3398  Bublic ip adress 81.15.15.200 privert ip adres of the LAN 192.168.0.2 Your lan host doesnt look correct is this a typo as it should be in the subnet your vlan 1 which is 192.168.40.0/24 Try the following: no ip nat inside source static tcp 192.168.40.3 3389 192.168.50.107 10000 extendable no ip route 0.0.0.0 0.0.0.0 192.168.50.254   ip nat inside source static tcp 192.168.X.2 3389 81.15.15.200 10015 ip route 0.0.0.0 0.0.0.0 FastEthernet4 dhcp   ... View more

Hello In your example you don’t have any ibgp peering, you are only allowing setting the local-preference path attribute for prefixes originating from ASN 11.   As stated by Jon, When you have two wan rtrs peering between two ISPs then you need an internal bgp peering between the two wan rtrs so to provide resiliency towards either ISP, However you also need to make sure you don’t become a transit path for these ISPs so you can use various path attributes such as local-preference , as-path filtering  and prepending for path manipulation and filtering.   Below is a basic example only advertising local originate routes to either ISP for both your sites wan rtrs, and making your the primary wan rtr the preferred path for all ingress/egress traffic.   no neighbor 1.1.1.1 route-map AS-11-INCOMING in no neighbor 1.1.1.1 route-map AS-11-OUTGOING out no route-map AS-11-INCOMING no ip as-path access-list 1 permit ^11$ no route-map AS-11-OUTGOING permit 20 no access-list 10 permit 2.2.2.0 0.0.0.255   Primary router ip as-path access-list 1 permit ^$   router bgp 12 bgp default local-preferance 50000 neighbor (ISP1) remote-as XX neighbor (ISP1) filter-list 1 out neighbor (Backup router) remote-as 12   Backup router ip as-path access-list 1 permit ^$ route-map AS-11-OUTGOING permit set as-path prepend 12 12 12 router bgp 12 bgp default local-preferance 10000 neighbor (ISP2) remote-as XX neighbor (ISP2) filter-list 1 out neighbor (ISP2) AS-11-OUTGOING OUT neighbor (primary router) remote-as 12   ... View more

Hello Try clearing the interface sh port-security interface x clear port-security interface x ... View more

Hello Does that server have two links into either core if so are they teamed? Do you have stp portfast enabled on these ports?   sh int trunk sh spanning-tree detail | i Port|VLAN|tra|BPDU ... View more

Hello @Cristian Matei  As I stated a previously I thought a mixture of nvi and hairpining should work regards the OP request - Anyway since @mustafa.chapal @confirmed the request i have managed to lab this up got a working solution ( in my last post) ... View more

Hello When you perform redistribution between different routing domains the prefixes that are redistributed need to be understood by that routing process own metrics they won’t be accepted ohterwise, In your configuration eigrp is redistribuitng ospf without any eigrp metric value appended and ospf is redistributing only eigrp classful subnets, try the following example: router ospf LAB redistribute eigrp 1 subnets match internal router eigrp 1 address-family ipv4 router-id 6.6.6.6 redistribute ospf LAB metric 1 1 1 1 1 ... View more

Hello Not so sure why you want to access the host via the public natted address and its internal address internally however depending on you ios software i think its applicable. Below is a possible solution using NVI nat, however depending on you IOS version you myabe  able to do this with domain nat  also. Example: no route-map 1 no access-list 1 no access-list 2 access-list 1 permit 10.0.0.0 0.0.0.255 access-list 2 remark CCP_ACL Category=2 access-list 2 permit 192.168.0.0 0.0.0.255 no ip nat source route-map 1 interface GigabitEthernet8 overload int loopback 100 ip address 169.254.1.1 255.255.255.255 ip nat enable interface GigabitEthernet8 ip address 99.80.10.233 255.255.255.248 no ip redirects no ip nat outside ip nat enable interface Vlan10 ip address 10.0.0.1 255.255.255.0 ip redirects ip nat enable interface Vlan20 ip address 192.168.0.1 255.255.255.0 ip redirects ip nat enable   ip access-list extended NAT permit ip 10.0.0.0 0.0.0.255 any permit ip 192.168.0.0 0.0.0.255 any ip access-list extended NAT-PIN permit ip 192.168.1.0 0.0.0.255 host 10.0.0.2   ip nat source static tcp 10.0.0.2 22 interface GigabitEthernet8 22 ip nat source list NAT interface GigabitEthernet8 ip nat source list NAT-PIN interface loopback 100 ip route 0.0.0.0 0.0.0.0 GigabitEthernet8 99.80.10.xxxx ... View more

Hello You can use snmp groups with ver3 also, However with v3 you have option for authentication and encryption to allow specify snmp views to specific OIDs  (create from here) within the SNMP MIB tree. Below is an example of using snmpv3 with read access to the configuration on the device using a snmp view/group/user with md5/3des authentication and encryption ( assumption your device and NMS supports this)   ip access-list extended SNMP_ACL permit ip host 172.168.12.x any snmp-server view CONFIG cisco.5.1.31.2.61 included snmp-server group SNMP-GRP v3 priv read CONFIG access SNMP_ACL snmp-server user Fred SNMP_GRP v3 auth md5 snmppassword priv 3des sharedkey123 ... View more

Hello   @mustafa.chapal wrote: Please tell me a way how can I SSH 99.80.10.233 from IP 192.168.0.10 in Vlan 20 as outside to inside does not seem to work So you wish to access internally, other internal hosts via their natted public address if so then youll need to nat hairpin for those internal subnets- please confirm? ... View more