Hi Guys, I'm seeking some clarification on the functionality of IP SLA authentication. I have configured an open ended responder on my network usign the ip sla responder command. I havea few routers using the device for various IP SLA monitors. I am now concerned that this device could be used in an unauthorised manner and wish to implement authentication. I've added a key-chain to my configuration on the responder as follows: key chain 1 key 1 key-string password I then enabled authentication on the responder using the ip sla key-chain 1 command and found that the initiators (without authentication configured) were still communicating with the target. Maybe I've misconfigured but I dont see it. Can anyone tell me if this is the normal behaviour and if so what function the authentication provides? Here's the associated config from the target: IPSVC_R2#sho run | sect sla ip sla responder ip sla key-chain 1 And here from a intiator: IPSVC_R1#sho run | sect sla ip sla key-chain 1 ip sla 1 icmp-echo 2.2.2.2 source-interface Loopback1 frequency 5 ip sla schedule 1 life 86400 start-time now key chain 1 key 1 key-string password Thanks Rgds Scott ... View more

Hi Guys, I havea number of contexts on my ASA5520's runing OS 8.3. I've created a capture in the admin coontext that I'd like to download to view in wireshark. Previously I've done this using the copy /pcap capture: command on ASAs in signle context mode but this command is not avaialble to me in my admin context. I the fucntionality still availble and if so, can anyone point me in the diretion of some instruction? TIA Rgds Scott ... View more

Hi Guys, I have an interesting situation here I'm having trouble testing in a lab. I have a external network directly connected to my core network. Due to physical connectivity constraints I cannot physically connect the external network to the DMZ. I require the external network traffic to terminate in the DMZ however it will need to traverse the core network infrastructure to reach it. The external network must not be able to gain direct access to services on the core network. I've devised a theoretical solution that I'm testing (with no success). The solution sees a GRE tunnel built between the external network and a router on the edge of the internal network (see attached diagram). Using PBR, the tunnel end device then pushes all traffic sourced from the external network through the firewall (into the DMZ). So the tunnel is up and the routing is in place. I can ping one end of the tunnel to the other. I cannot ping from an external host to the dmz. Doign a packet capture I see the traffic go from the internal router, all the way to the external router and then go no where. As I'm pinigng the external facing interface of the external router I cant see it being a routing issue. There is no ative firewall in place so I'm nto sure waht the problem is. I've attached the config of the both the tunnel endpoints. R1 is the external router (192.168 is the external network) and R4 is the internal router. R5 is the DMZ firewall (its just a router). I'm nto really looking for a config fix, rather proof that this concept works. If anyone can replicate it and share the config that'd be just as helpful. Also happy to entertain any alternate design considerations. TIA Rgds Scott GRE_R4#sho run Building configuration... Current configuration : 1141 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname GRE_R4 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! ! ! no ip domain lookup ip auth-proxy max-nodata-conns 3 ip admission max-nodata-conns 3 ! interface Tunnel0 ip address 100.0.0.2 255.255.255.252 tunnel source FastEthernet0/0 tunnel destination 100.0.0.1 ! interface FastEthernet0/0 ip address 4.4.4.2 255.255.255.252 duplex auto speed auto ! interface FastEthernet0/1 ip address 10.16.96.1 255.255.255.0 duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 2.2.2.5 ip route 0.0.0.0 0.0.0.0 4.4.4.1 ip route 1.1.1.1 255.255.255.255 2.2.2.1 ip route 1.1.1.1 255.255.255.255 4.4.4.1 ip route 100.0.0.1 255.255.255.255 2.2.2.5 ip route 100.0.0.1 255.255.255.255 4.4.4.1 ip route 192.168.0.0 255.255.0.0 Tunnel0 ! ! line con 0 exec-timeout 0 0 logging synchronous line aux 0 line vty 0 4 login ! ! end GRE_R1#sho run Building configuration... Current configuration : 1047 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname GRE_R1 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! ! ! no ip domain lookup ip auth-proxy max-nodata-conns 3 ip admission max-nodata-conns 3 ! ! interface Tunnel0 ip address 100.0.0.1 255.255.255.252 tunnel source FastEthernet0/0 tunnel destination 100.0.0.2 ! interface FastEthernet0/0 ip address 1.1.1.1 255.255.255.252 duplex auto speed auto ! interface FastEthernet0/1 ip address 192.168.13.11 255.255.255.0 secondary ip address 192.168.13.10 255.255.255.0 duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Tunnel0 ip route 2.2.2.2 255.255.255.255 1.1.1.2 ip route 100.0.0.2 255.255.255.255 1.1.1.2 ! ! no ip http server no ip http secure-server ! no cdp run ! ! ! control-plane ! line con 0 exec-timeout 0 0 logging synchronous line aux 0 line vty 0 4 login ! ! end GRE_R1# ... View more