Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About JRDIAZ758
Stats
Member since
07-23-2013
39
Posts
16
Helpful
0
Solutions
05-04-2018
07:25 AM
i had the situation where a semi smart small switch connected to a 3750-48T someone connected it twice to it. and it wrecked havoc on everyone connected to that VLAN. the CPU went to the roof and you couldn't even ping the gateway (data plane overload?) this type of loop is very hard to contain since the switch does not send tags nor BPDUs thru access ports. it was forwarding any bcast traffic in an endless loop.
i had to turn on broadcast control and set it to 1% and port security to a MAX of 5 per port.
... View more
05-04-2018
06:03 AM
im trying to upgrade to 6.2.3.1 from 6.1.0.3
the upgrade path is 6.1.0.3>6.2.0>6.2.3>6.2.3.1
but it said that in 6.2.0 they recommend a hot-fix 6.2.0.5 .. do i need to install the update or can i ignore it and go to 6.2.3 ?
... View more
02-12-2018
10:34 AM
what if you have the ACL in place and not the inter-interface command.
would that cause traffic not to be allowed ?
... View more
02-12-2018
08:04 AM
im having the same issue as well , trying to go from XXXdmz host to YYYYDMZ a web server https
2
10:18:00
106001
10.60.65.1
25812
10.11.167.110
443
Inbound TCP connection denied from 10.60.65.1/25812 to 10.11.167.110/443 flags SYN on interface XXXdmz
XXXdmz is sec level 30 as well as the YYYYdmz that in trying to go to. routes are dynamically learned
packet-tracer input ccidmz tcp 10.60.65.1 25812 10.11.167.110 443
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 3
Type: RECURSIVE-ROUTE-LOOKUP
Subtype: Recursive Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
in 10.11.167.0 255.255.255.0 via 172.16.160.1, YYYYDMZ (resolved, timestamp: 528790)
Phase: 4
Type: RECURSIVE-ROUTE-LOOKUP
Subtype: Recursive Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
in 172.16.160.0 255.255.255.248 YYYYDMZ
Phase: 5
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 172.16.160.1 using egress ifc YYYYDMZ
Phase: 6
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Result:
input-interface: XXXdmz
input-status: up
input-line-status: up
output-interface: YYYYDMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
... View more
02-08-2018
06:58 AM
We are trying to disable the Clientless VPN , we only use Anyconnect client. it was my understanding that webvpn was only for the clientless vpn feature. Please correct me if im wrong..
... View more
Created by
JRDIAZ758
in Cisco Bug Discussions
in Cisco Bug Discussions
02-05-2018
11:45 AM
02-05-2018
11:45 AM
I am already off 9.6.1 ... currently using 9.6.3.20...what i want to confirm if that one is now vulnerable ,,,
... View more
Created by
JRDIAZ758
in Cisco Bug Discussions
in Cisco Bug Discussions
02-05-2018
11:19 AM
02-05-2018
11:19 AM
a TAC to us "Unfortunately version 9.6(1) it is affected, the fixed release is 9.6.3.20. We encourage to our customers to make the necessary upgrades that ensure security"
So we proceeded to upgrade to that version. Does this mean we will need to upgrade again?
... View more
08-04-2017
05:03 AM
i still do not have the new one. but in cisco advisor, it list one as 5515x-k9 and the old as 5515x-MB, below is the show version of the 5515x-MB. i know K9 has more to do with the encryption level the box comes with. so im curios as to what MB stands for.
show inventory Name: "Chassis", DESCR: "ASA 5515-X with SW, 6 GE Data, 1 GE Mgmt, AC" PID: ASA5515 , VID: V01 ,
show version
Cisco Adaptive Security Appliance Software Version 9.6(1) Device Manager Version 7.6(2)150
Compiled on Fri 18-Mar-16 14:08 PDT by builders System image file is "disk0:/asa961-smp-k8.bin" Config file at boot was "startup-config"
asa-TEST up 84 days 8 hours failover cluster up 84 days 8 hours
Hardware: ASA5515, 8192 MB RAM, CPU Clarkdale 3058 MHz, 1 CPU (4 cores) ASA: 4105 MB RAM, 1 CPU (1 core) Internal ATA Compact Flash, 8192MB BIOS Flash MX25L6445E @ 0xffbb0000, 8192KB
Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1) Boot microcode : CNPx-MC-BOOT-2.00 SSL/IKE microcode : CNPx-MC-SSL-SB-PLUS-0005 IPSec microcode : CNPx-MC-IPSEC-MAIN-0026 Number of accelerators: 1 Baseboard Management Controller (revision 0x1) Firmware Version: 2.4
0: Int: Internal-Data0/0 : address is 6c41.6a1f.3105, irq 11 1: Ext: GigabitEthernet0/0 : address is 6c41.6a1f.3109, irq 10 2: Ext: GigabitEthernet0/1 : address is 6c41.6a1f.3106, irq 10 3: Ext: GigabitEthernet0/2 : address is 6c41.6a1f.310a, irq 5 4: Ext: GigabitEthernet0/3 : address is 6c41.6a1f.3107, irq 5 5: Ext: GigabitEthernet0/4 : address is 6c41.6a1f.310b, irq 10 6: Ext: GigabitEthernet0/5 : address is 6c41.6a1f.3108, irq 10 7: Int: Internal-Data0/1 : address is 0000.0001.0002, irq 0 8: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 0 9: Int: Internal-Data0/2 : address is 0000.0001.0003, irq 0 10: Ext: Management0/0 : address is 6c41.6a1f.3105, irq 0
Licensed features for this platform: Maximum Physical Interfaces : Unlimited perpetual Maximum VLANs : 100 perpetual Inside Hosts : Unlimited perpetual Failover : Active/Active perpetual Encryption-DES : Enabled perpetual Encryption-3DES-AES : Enabled perpetual Security Contexts : 2 perpetual Carrier : Disabled perpetual AnyConnect Premium Peers : 2 perpetual AnyConnect Essentials : Disabled perpetual Other VPN Peers : 250 perpetual Total VPN Peers : 250 perpetual AnyConnect for Mobile : Disabled perpetual AnyConnect for Cisco VPN Phone : Disabled perpetual Advanced Endpoint Assessment : Disabled perpetual Shared License : Disabled perpetual Total UC Proxy Sessions : 2 perpetual Botnet Traffic Filter : Disabled perpetual IPS Module : Disabled perpetual Cluster : Enabled perpetual Cluster Members : 2 perpetual
This platform has an ASA 5515 Security Plus license.
Failover cluster licensed features for this platform: Maximum Physical Interfaces : Unlimited perpetual Maximum VLANs : 100 perpetual Inside Hosts : Unlimited perpetual Failover : Active/Active perpetual Encryption-DES : Enabled perpetual Encryption-3DES-AES : Enabled perpetual Security Contexts : 4 perpetual Carrier : Disabled perpetual AnyConnect Premium Peers : 4 perpetual AnyConnect Essentials : Disabled perpetual Other VPN Peers : 250 perpetual Total VPN Peers : 250 perpetual AnyConnect for Mobile : Disabled perpetual AnyConnect for Cisco VPN Phone : Disabled perpetual Advanced Endpoint Assessment : Disabled perpetual Shared License : Disabled perpetual Total UC Proxy Sessions : 4 perpetual Botnet Traffic Filter : Disabled perpetual IPS Module : Disabled perpetual Cluster : Enabled perpetual
This platform has an ASA 5515 Security Plus license.
Image type : Release Key version : A
... View more
08-03-2017
07:14 AM
i cant find what is the difference between 5515-mb and 5515x-k9,,,, we purchased a new one to complete the HA pair. anyone knows if they wont have any problems running failover between them?
... View more
Labels:
07-19-2017
11:28 AM
are running the same ASA IOS as the 5515x? are all features avaible, like HA etc?
... View more
04-18-2017
05:45 AM
i dont see any hits, but the traffic coming into the g1/0/23 is pretty much what its coming from the client, (RTP traffic and WMview traffic) is what i put in the ACL.
show access-lists priority_mark_voip Extended IP access list priority_mark_voip 80 permit udp any any range 5000 65535
show access-lists priority_mark_data Extended IP access list priority_mark_data 80 permit tcp any any eq www 90 permit tcp any any eq 443 100 permit tcp any any eq 4172 110 permit udp any any eq 4172
... View more
04-17-2017
12:03 PM
Hey, ive been trying to get a simple QoS Implementation to work. we purchased a stack of 3850s for incoming traffic from clients. so ive been trying to marking incoming packets from the client network with specific DSCP and then apply priority based on those DSCP values. it doesnt seem to be marking anything thus making the outbound policy-map restrict have lots of output drops.
what am i missing here?
so its:
client -----------> ( g1/0/23 .core. g1/1/4) -------> MPLS Link
!!!! creating ACLs/Class Maps for traffic
ip access-list extended priority_mark_voip
permit udp any any range 5000 65535
ip access-list extended priority_mark_data
permit tcp any any eq www
permit tcp any any eq 443
permit tcp any any eq 4172
permit udp any any eq 4172
class-map match-any priority_Data
match access-group name priority_mark_data
class-map match-any priority_voip_marking
match access-group name priority_mark_voip
!
class-map match-any client_traffic_data
match dscp cs2
class-map match-any client_traffic_voip
match dscp ef
!!!!!! policy-Map for incoming traffic
policy-map classifying_traffic
class priority_voip_marking
set dscp ef
class priority_data_marking
set dscp cs2
!!!!!!!! policy map for outging traffic
policy-map priority_traffic_prod
class client_traffic_voip
priority percent 50
class client_traffic_data
priority percent 40
policy-map port_child_policy
class non-client-nrt-class
bandwidth remaining ratio 10
!!!!!!!!!! applying Policy-MAPs
interface g1/0/23
service-policy input classifying_traffic
interface GigabitEthernet1/1/4
service-policy output priority_traffic_prod
!!!! show policy-map show no packets being marked/classified.
GigabitEthernet1/0/23
Service-policy input: classifying_traffic
Class-map: priority_voip_marking (match-any)
870640040 packets
Match: access-group name priority_mark_voip
0 packets, 0 bytes
5 minute rate 0 bps
QoS Set
dscp ef
Class-map: priority_data_marking (match-any)
117512 packets
Match: access-group name priority_mark_data
0 packets, 0 bytes
5 minute rate 0 bps
QoS Set
dscp cs2
Class-map: class-default (match-any)
13515093 packets
Match: any
... View more
- Tags:
- qos c3850
Labels:
03-29-2017
02:41 PM
i got this exact same issue, but in this case im talking ebgp to my ISP and ospf to my internal network.
BGP
OSPF
EIGRP
Site MPLS router(10.8.0.0)------ ISP--------MPL S-router-------core----------vpn-RO UTER---------Site-VPN-rotuer(10.8.0.0)
MPLS-ROUTER#sh ip bgp 10.8.0.0 BGP routing table entry for 10.8.0.0/0, version 4052328 Paths: (2 available, best #2, table Default-IP-Routing-Table) Not avertised to any Peer Refresh epoch 7029 65005, (received & used) 40.135.119.41 from 40.135.119.41 (169.130.66.137) Origin IGP, localpref 100, valid, external LOCAL 10.215.5.9 from 0.0.0.0 (10.215.0.5) Origin Incomplete, metric 20, localpref 100, weight 32728 , valid, sourced, best
... View more
03-15-2017
12:37 PM
i see, i dont know why they would order half of the switches with that IOS :/ , i guess its upgrade time.
... View more
08-17-2018
we are seeing a lot of the messages below when looking at the reports,
Does anyone know what they me...
05-04-2018
i had the situation where a semi smart small switch connected to a
3750-48T someone connected it twi...
05-04-2018
im trying to upgrade to 6.2.3.1 from 6.1.0.3 the upgrade path is
6.1.0.3>6.2.0>6.2.3>6.2.3.1 but it ...
02-12-2018
what if you have the ACL in place and not the inter-interface command.
would that cause traffic not ...
02-12-2018
im having the same issue as well , trying to go from XXXdmz host to
YYYYDMZ a web server https 2 10:...
02-08-2018
We are trying to disable the Clientless VPN , we only use Anyconnect
client. it was my understanding...
02-05-2018
I am already off 9.6.1 ... currently using 9.6.3.20...what i want to
confirm if that one is now vuln...
02-05-2018
a TAC to us "Unfortunately version 9.6(1) it is affected, the fixed
release is 9.6.3.20. We encourag...
08-04-2017
My problem is not high CPU. just Snort crashing. i dont know if 29%
memory consumption is normal. bu...
08-04-2017
Well, TAC is asking me to turn this on to see if it helps on my snort
process crashing. i am running...
08-04-2017
i still do not have the new one. but in cisco advisor, it list one as
5515x-k9 and the old as 5515x-...
Public Statistics
| Date Registered | 07-23-2013 10:37 AM |
| Date Last Visited | 08-27-2018 06:24 PM |
| Total Messages Posted | 39 |
| Total Helpful Votes Received | 16 |
Helpful Votes From
