@eduangelo wrote: Hi, people    I am in the my city and i want to access a switch remotely. is it enough know IP management of the switch ?  Yes it is providing the address and port of the switch is reachable from where you are trying to access it       ... View more

Hello just like to add- Thr problem doesn’t seem the establishment of the isakmp-IPSec sa’s it’s sounds like an intermittent issue correct?   Areyou sure this isnt a physical issue regards the connectivity between the asa and rtr ?   That said possibly suggest to check also any IPSec idle timeout values being set or not   ... View more

Hello Powerdown end devices -servers  etc.. access- layer switches  distribution core wan rtrs Telco circuits   Power up  reverse powerdown sequence   Suggest leave a few minutes between each  shutdown/restart to make sure each layer-device comes up as expected  - take snapshots of route tables -traceroutes-extended pings - best paths - active interfaces - stackable switch orders device neighbours igp- bgp peers etc.. ... View more

Hello If you use public addressing from which isp are you going to use it from?  Also you dont want to be advertising isp addressing from within your internal network possibly incurring transient traffic between through your wan rtr's   Go with internal addressing, no need for public - your isps will be aware of your internal network anyway. ... View more

Hello Would be best to view your existing configuration to see how you are currently performing the routing however it may be just be as simple as advetising a default route into your vrfA table to point to the global route next-hop of internetB   however without seeing your current setup it would be hard to confirm-   Example : ip route vrfA 0.0.0.0 0.0.0.0. (Nexthop) global      ... View more

Hello @Joe22 wrote: I want to create an isolated Test vlan (172.16.112.0/24): Inbound - only allow inbound RDP to any host within the Test vlan Outbound - deny all so that any hosts in the Test vlan can't contact production What is the production vlan subnet? -  example 10.10.10.0/24   ip access-list extended  test_vlan_acl remark Isolate test vlan from production permit tcp 10.10.10.0 0.0.0.255 any eq 3389 deny ip 10.10.10.0 0.0.0.255 any permit ip any any   ip access-list extended  test_vlan_acl_in remark Isolate test vlan from production permit tcp any 10.10.10.0 0.0.0.255  eq 3389 deny ip any 10.10.10.0 0.0.0.255  permit ip any any int vlan 102 ip access-group test_vlan_acl out ip access-group test_vlan_acl_in in ... View more

Hello Unfortunaley not enough information at this time to provide an acurate suggestion howerver you have options to employ various desgins for HA even routing resilency but for that can you provide some more detail surrounding the connectivity towards your ISPs.     ... View more

Hello So are just wireless users  having issues connecting to the mgt vlan or wired also? I am assuming looking at the config youve posted that the 7K is perfroming the intervlan routing for both sites? Are you using any fabric extenders? How are you trying to connect to the mgt vlan and where from, does it work from anywhere in the estate? Can you post the config of the 7K and site A/Bs accesss switches if applicable and maybe a simple toplogy of your network ... View more

Hello @qavlow wrote: Below are my setting for the Vlan and ip Vlan 1 :10.0.0.254/24 Vlan 6: 10.0.6.254/24 Vlan 10: 10.0.10.254/24  Management Vlan   I would like to allow connection from Vlan 10 to Vlan 6 but blocking connection from vlan 6 to vlan 10.? try this: ip access-list extended Vl6-V10 remark Deny Vlan6 to initiate connection to Vlan10 permit tcp 10.0.6.0 0.0.0.255 any established deny tcp 10.0.6.0 0.0.0.255 any permit ip any any   int vlan 10 Ip access-group Vl6-V10 out ... View more

Hello 1) Remove the static routes for each tunel interfaces that are pointing to what looks like a recursive next-hop Head no ip route 10.192.0.17 255.255.255.255 198.190.160.1   Spoke no ip route 10.192.0.254 255.255.255.255 2.2.2.1 2) Check your default routes to make sure their next-hop address are correct as it lookslike you have typo's Head ip route 0.0.0.0 0.0.0.0 1.1.1.1 < ? interface GigabitEthernet0/0/1  description WAN UPLINK  ip address 1.1.1.1 255.255.255.0 3) router ospf 1 passive interface default no passive interface tunnel x ... View more

Hello Your Local span session at this time looks correct, Just wondering if your traffic analyzer is working accordingly  and nothing is negating it working on the device attached to your span destination port? Can you turn off any software fw running on the capture device just for testing purposes? Lastly reading you previous config posts please note spanned sources cannot be vlans and ports at the same time you cannot mix them, its either one of the other ... View more

Hello   Tested in 802.1d stp: spanning-tree portfast bpdufilter default (Global - no stp postfast) -listening/learning/forwarding (rouge switch becomes root no filtering occurs) spanning-tree bpdufilter enable (interface mode - no stp postfast)) -listening/learning/forwarding (rouge switch becomes root no filtering occurs)   (global command) spanning-tree portfast default spanning-tree portfast bpdufilter default- jumps to forwarding from blocking (rouge switch becomes root no filtering occurs) spanning-tree portfast bpdufilter default spanning-tree portfast – (interface mode) -jumps to forwarding from blocking (rouge switch becomes root no filtering occurs)   spanning-tree portfast default spanning-tree bpdufilter enable – (interface mode) jumps to forwarding from blocking ( keeps root status – bpdu’s are filtered) spanning-tree portfast – (interface mode) spanning-tree bpdufilter enable– (interface mode) jumps to forwarding from blocking ( keeps root status –  bpdu’s are filtered)   Tested in 802.1w stp: Portfast - (global) spanning-tree portfast bpdufilter default (Global) transmits 2x proposals goes into Fwd state - no blocking (rouge switch becomes root no filtering occurs) Portfast - (global) spanning-tree bpdufilter enable (interface mode) -initializes port goes straight to fwd state (so looks like bpdu’s are filtered) spanning-tree portfast (interface) spanning-tree portfast bpdufilter enable- initializes port goes straight to fwd state (so looks like bpdu’s are filtered)   ... View more

Helloi if ip cef isn’t enabled by default which I think it will be then you can enable it   sh ip cef   Conf t io cef enable   interface x/x ip load-sharing per-packet ... View more