Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About JMaartenW
09-25-2018
Stats
Member since
10-07-2013
18
Posts
0
Helpful
0
Solutions
Created by
JMaartenW
in Other Network Architecture Subjects
in Other Network Architecture Subjects
09-18-2018
09:15 AM
09-18-2018
09:15 AM
do you know what!!! I've looked and changed that several times and now realise the typo in 0x2100
THANK YOU so much!! i'm off to specsavers :)
... View more
Created by
JMaartenW
in Other Network Architecture Subjects
in Other Network Architecture Subjects
09-18-2018
08:18 AM
09-18-2018
08:18 AM
I am able to boot into the IOS but only manually from ROMMON the device will not power up into ios automatically. is it something to do with this bootstrap which is still showing the old version how do I change that?
Cisco IOS Software, C800 Software (C800-UNIVERSALK9-M), Version 15.7(3)M1, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2017 by Cisco Systems, Inc. Compiled Thu 30-Nov-17 03:00 by prod_rel_team
ROM: System Bootstrap, Version 15.4(1r)T1, RELEASE SOFTWARE (fc1)
SIDCIS91FVOIP1 uptime is 1 hour, 55 minutes System returned to ROM by reload at 13:30:26 PCTime Tue Sep 18 2018 System image file is "flash:c800-universalk9-mz.SPA.157-3.M1.bin" Last reload type: Normal Reload Last reload reason: Reload Command
...
Cisco C891F-K9 (revision 1.0) with 488524K/35763K bytes of memory. Processor board ID FCZ*********3 1 FastEthernet interface 9 Gigabit Ethernet interfaces 1 Serial interface 1 ISDN Basic Rate interface 1 terminal line 1 Virtual Private Network (VPN) Module DRAM configuration is 32 bits wide 255K bytes of non-volatile configuration memory. 250880K bytes of ATA System CompactFlash (Read/Write)
License Info:
License UDI:
------------------------------------------------- Device# PID SN ------------------------------------------------- *1 C891F-K9 FCZ*******3
License Information for 'c800' License Level: advipservices Type: Permanent Next reboot license Level: advipservices
Configuration register is 0x2100
... View more
Created by
JMaartenW
in Other Network Architecture Subjects
in Other Network Architecture Subjects
09-18-2018
06:19 AM
09-18-2018
06:19 AM
I have issues upgrading this router due to "not enough space" problems
I was unable to upgrade the running-config tftp
(copy tftp://ip address/ c800-universalk9-mz.SPA.157-3.M1.bi n run)
so I uploaded the config to Flash (copy tftp://ip address/c800-universalk9-mz.SPA.157-3.M1.bin flash)
I then deleted the old config and attempted to ensure the router would boot from the new config only.
even though the new config now shows correctly in Flash and in Rommon the router still will only boot into Rommon what am I missing here? do I really have to upgrade the memory?
rommon 7 > dir flash: Directory of flash:
2 96136084 -rw- c800-universalk9-mz.SPA.157-3.M1.bin 16720 780 -rw- vlan.dat 40190 0 drw- managed 40194 0 drw- eem
SIDCIS91FVOIP1#sh flash: -#- --length-- -----date/time------ path 1 96136084 Sep 18 2018 04:42:46 +01:00 c800-universalk9-mz.SPA.157-3.M1.bin 2 780 Dec 15 2017 15:00:58 +00:00 vlan.dat 3 0 Sep 17 2018 19:24:28 +01:00 managed 4 0 Sep 17 2018 19:24:30 +01:00 managed/odm 5 21341 Sep 17 2018 19:24:34 +01:00 managed/odm/cg-dm.odm 6 21341 Sep 17 2018 19:24:36 +01:00 managed/odm/cg-nms.odm 7 21341 Sep 17 2018 19:24:38 +01:00 managed/odm/cg-dm-1.0.odm 8 21341 Sep 17 2018 19:24:38 +01:00 managed/odm/cg-nms-1.0.odm 9 0 Sep 17 2018 19:24:32 +01:00 managed/scripts 10 3235 Sep 17 2018 19:24:36 +01:00 managed/scripts/cg-nms-scripts.tcl 11 3235 Sep 17 2018 19:24:40 +01:00 managed/scripts/cg-nms-scripts-1.0.tcl 12 0 Sep 17 2018 19:24:32 +01:00 managed/reprovision 13 0 Sep 17 2018 19:24:34 +01:00 eem
160235520 bytes available (96268288 bytes used)
boot-start-marker boot system flash:c800-universalk9-mz.SPA.157-3.M1.bin boot-end-marker
... View more
Labels:
05-02-2014
12:05 PM
Hi, I know this question is probably very common but I am still having issues with understanding ACL's I've read so much documentation but its not helping me understand or apply the knowledge to my situation. basically I have configured a new CISCO 891 router with a number of VPN's connected and a couple of inbound rules to allow rdp and sql traffic to 2 servers on my LAN. to do this I have created ACL 130 and matched it to the inbound direction of the WAN interface. the confusion is that I would really like the last default rule to be a "deny any any" rule for security. but no matter what I do, even if I create a specific permit rule for web traffic and DNS if I change the last rule to "deny any to any" all my internet connectivity stops working apart from my traffic over the VPN I cannot browse or resolve or ping anything on the internet. here is my config if anyone can advise me how to ensure my Cisco891 firewall is secure I would be grateful. (PS I've given up trying to use the ZBF as this created even more issues and now only using CLI) Building configuration... Current configuration : 9409 bytes ! ! Last configuration change at 20:53:43 PCTime Mon Apr 28 2014 by admin version 15.2 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname LBHCIS891DATA1 ! boot-start-marker boot-end-marker ! ! security authentication failure rate 10 log security passwords min-length 6 logging buffered 51200 errors logging console critical enable secret 4 MHpke6/RnYLNL/fAD5EKDxml.aj8Sr4IJfubMQjIoB2 enable password 7 08331D1F074D031A39 ! aaa new-model ! ! aaa authentication login local_auth local aaa authentication enable default enable ! ! ! ! ! aaa session-id common memory-size iomem 10 clock timezone PCTime 0 0 clock summer-time PCTime date Mar 30 2003 1:00 Oct 26 2003 2:00 ! crypto pki trustpoint TP-self-signed-3955790181 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-3955790181 revocation-check none rsakeypair TP-self-signed-3955790181 ! crypto pki trustpoint TP-self-signed-3612796534 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-3612796534 revocation-check none rsakeypair TP-self-signed-3612796534 ! crypto pki trustpoint test_trustpoint_config_created_for_sdm subject-name e=sdmtest@sdmtest.com revocation-check crl ! crypto pki trustpoint TP-self-signed-1280197465 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-1280197465 revocation-check none rsakeypair TP-self-signed-1280197465 ! ! crypto pki certificate chain TP-self-signed-3955790181 crypto pki certificate chain TP-self-signed-3612796534 crypto pki certificate chain test_trustpoint_config_created_for_sdm crypto pki certificate chain TP-self-signed-1280197465 vlan ifdescr detail no ip source-route no ip gratuitous-arps ip cef ! ! ! ! ! ! ! ! no ip bootp server ip domain name <Internal domain name> ip name-server 8.8.8.8 ip name-server 172.24.4.13 ip name-server 172.24.16.13 ip name-server 172.24.16.15 ip inspect log drop-pkt login block-for 5 attempts 10 within 5 no ipv6 cef ! parameter-map type inspect global log dropped-packets enable max-incomplete low 18000 max-incomplete high 20000 spoofed-acker off ! ! ! ! multilink bundle-name authenticated ! ! ! ! ! ! license udi pid CISCO891-K9 sn FCZ1813C2XL ! ! username admin privilege 15 secret 4 MHpke6/RnYLNL/fAD5EKDxml.aj8Sr4IJfubMQjIoB2 ! redundancy ! ! ! ! ! ip tcp synwait-time 10 no ip ftp passive ip ssh time-out 60 ip ssh authentication-retries 2 ip ssh version 2 ! crypto logging ezvpn ! crypto isakmp policy 20 encr 3des authentication pre-share group 2 crypto isakmp key ******************* address (PEER IP) crypto isakmp keepalive 10 5 crypto isakmp aggressive-mode disable ! crypto ipsec security-association lifetime seconds 86400 ! crypto ipsec transform-set ADAPTVPN esp-3des esp-sha-hmac mode tunnel ! crypto ipsec profile ADAPT_IPSEC_POLICY set transform-set ADAPTVPN ! ! ! crypto map ADAPTVPN 200 ipsec-isakmp set peer <<VPN PEER IP> set transform-set ADAPTVPN match address VPNSITE ! ! ! ! ! interface Null0 no ip unreachables ! interface FastEthernet0 description VLAN 1 Trunk port switchport mode trunk no ip address ! interface FastEthernet1 description VLan 1 Access port no ip address ! interface FastEthernet2 description Vlan 1 Access port no ip address ! interface FastEthernet3 description Vlan 1 Access port no ip address ! interface FastEthernet4 description Vlan 1 Access port no ip address ! interface FastEthernet5 description Vlan 1 Access port no ip address ! interface FastEthernet6 description VLAN 50 access port switchport access vlan 50 no ip address ! interface FastEthernet7 description VLAN50 trunk port switchport access vlan 50 switchport trunk native vlan 50 switchport mode trunk no ip address ! interface FastEthernet8 no ip address shutdown duplex auto speed auto ! interface GigabitEthernet0 description WAN 1 interface for LBHETH-WAN$$ETH-WAN$ ip address <Wan int Public IP add> 255.255.255.192 ip access-group 130 in no ip redirects no ip unreachables no ip proxy-arp ip nat outside ip virtual-reassembly in duplex auto speed auto crypto map ADAPTVPN ! interface Vlan1 description $FW_INSIDE$ ip address 172.24.16.241 255.255.252.0 no ip redirects no ip unreachables no ip proxy-arp ip nbar protocol-discovery ip flow ingress ip flow egress ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Vlan50 description $FW_INSIDE$ ip address 172.17.116.241 255.255.255.0 ip nat inside ip virtual-reassembly in ! interface Async1 no ip address encapsulation slip shutdown ! ip forward-protocol nd ip http server ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ! ip flow-top-talkers top 10 sort-by bytes cache-timeout 10000 ! ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0 overload ip nat inside source static tcp 172.24.16.19 1433 <Wan int Public IP add> 1433 extendable ip nat inside source static tcp 172.24.16.25 3389 <Wan int Public IP add> 3389 extendable ip route 0.0.0.0 0.0.0.0 <Wan int Gateway> ! ip access-list extended VPNSITE remark CCP_ACL Category=5 remark access all sites permit ip 172.24.16.0 0.0.3.255 172.24.0.0 0.0.255.255 remark voip permit ip 172.24.16.0 0.0.3.255 172.17.0.0 0.0.255.255 remark webmail permit ip 172.24.16.0 0.0.3.255 192.168.102.0 0.0.0.255 remark a cloud permit ip 172.24.16.0 0.0.3.255 192.168.25.0 0.0.0.255 remark a cloud test permit ip 172.24.16.0 0.0.3.255 192.168.26.0 0.0.0.255 remark a cloud public permit ip 172.24.16.0 0.0.3.255 192.168.27.0 0.0.0.255 remark voip permit ip 172.17.116.0 0.0.0.255 172.17.0.0 0.0.255.255 permit ip 172.17.116.0 0.0.0.255 172.24.0.0 0.0.255.255 ! ip sla auto discovery logging trap debugging logging facility local2 logging host 172.24.4.51 access-list 102 remark CCP_ACL Category=2 access-list 102 remark acloud public access-list 102 deny ip 172.24.16.0 0.0.3.255 192.168.27.0 0.0.0.255 access-list 102 remark acloud test access-list 102 deny ip 172.24.16.0 0.0.3.255 192.168.26.0 0.0.0.255 access-list 102 remark acloud access-list 102 deny ip 172.24.16.0 0.0.3.255 192.168.25.0 0.0.0.255 access-list 102 remark oa.accessnet.co.uk access-list 102 deny ip 172.24.16.0 0.0.3.255 192.168.102.0 0.0.0.255 access-list 102 remark voip access-list 102 deny ip 172.24.16.0 0.0.3.255 172.17.0.0 0.0.255.255 access-list 102 remark access all sites access-list 102 deny ip 172.24.16.0 0.0.3.255 172.24.0.0 0.0.255.255 access-list 102 remark voip access-list 102 deny ip 172.17.116.0 0.0.0.255 172.17.0.0 0.0.255.255 access-list 102 remark access all sites access-list 102 deny ip 172.17.116.0 0.0.0.255 172.24.0.0 0.0.255.255 access-list 102 permit ip 172.24.16.0 0.0.3.255 any access-list 102 permit ip 172.17.116.0 0.0.0.255 any access-list 130 remark EXT_ACL access-list 130 permit ip 172.24.0.0 0.0.255.255 172.17.116.0 0.0.0.255 access-list 130 remark voip access-list 130 permit ip 172.17.0.0 0.0.255.255 172.17.116.0 0.0.0.255 access-list 130 remark acloud public access-list 130 permit ip 192.168.27.0 0.0.0.255 172.24.16.0 0.0.3.255 access-list 130 remark acloud test access-list 130 permit ip 192.168.26.0 0.0.0.255 172.24.16.0 0.0.3.255 access-list 130 remark acloud access-list 130 permit ip 192.168.25.0 0.0.0.255 172.24.16.0 0.0.3.255 access-list 130 remark oa.accessnet.co.uk access-list 130 permit ip 192.168.102.0 0.0.0.255 172.24.16.0 0.0.3.255 access-list 130 remark voip access-list 130 permit ip 172.17.0.0 0.0.255.255 172.24.16.0 0.0.3.255 access-list 130 remark access all sites access-list 130 permit ip 172.24.0.0 0.0.255.255 172.24.16.0 0.0.3.255 access-list 130 permit udp host <VPN PEER IP> host <Wan int Public IP add> eq non500-isakmp access-list 130 permit udp host <VPN PEER IP> host <Wan int Public IP add> eq isakmp access-list 130 permit esp host <VPN PEER IP> host <Wan int Public IP add> access-list 130 permit ahp host <VPN PEER IP> host <Wan int Public IP add> access-list 130 permit tcp host <a webserver> host <Wan int Public IP add> eq 1433 log access-list 130 permit tcp any host <Wan int Public IP add> eq 3389 log access-list 130 permit ip host <a Public Ip I need> host <Wan int Public IP add> access-list 130 permit tcp any host <Wan int Public IP add> eq www access-list 130 permit tcp any host <Wan int Public IP add> eq 443 access-list 130 permit tcp any host <Wan int Public IP add> eq domain access-list 130 deny tcp any host <Wan int Public IP add> eq 1433 access-list 130 permit icmp any host <Wan int Public IP add> access-list 130 permit ip any any no cdp run ! route-map SDM_RMAP_1 permit 1 match ip address 102 ! ! ! ! ! control-plane ! ! ! ! mgcp profile default ! ! ! ! ! ! line con 0 login authentication local_auth transport output telnet line 1 modem InOut speed 115200 flowcontrol hardware line aux 0 login authentication local_auth transport output telnet line vty 0 4 exec-timeout 30 0 privilege level 15 password 7 09554B1A transport preferred ssh transport input ssh transport output ssh ! scheduler interval 500 ntp update-calendar ntp server 0.uk.pool.ntp.org ! end
... View more
Labels:
12-13-2013
03:23 AM
Thank you so much for your help in this. I will go ahead and figure out how to apply those and then re-enable the ZBF
... View more
12-12-2013
03:52 PM
hi no ZBF at the moment obviously I'm going to have to put it back and I probably will use the CCP wizard for that as its lots of lines of code but hopefully it wo't break anything and it will allow for the already active VPN tunnel which is in place. ( last time I created the ZBF before setting up the tunnel ) the added rules are: ip access-list extended all_traffic-Out permit icmp 172.17.205.0 0.0.0.255 any permit ip 172.17.205.0 0.0.0.255 any ip access-list extended all_traffic_in permit ip 172.17.104.0 0.0.0.255 any log permit ip 172.17.112.0 0.0.0.255 any log permit ip 172.24.4.0 0.0.0.255 any log
... View more
12-12-2013
09:11 AM
hi I intially tried removing the interfaces from the zones but I was still unable to ping anything from the VLAN1 interface.through the router. i then removed the entire zone firewall and zones but was still not able to ping anything I then added some new ACL's and hey presto... weird but true my new config in its entirity now looks like this Building configuration... Current configuration : 10061 bytes ! ! Last configuration change at 17:47:40 PCTime Thu Dec 12 2013 by admin version 15.3 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname HSTCIS887VOIP1 ! boot-start-marker boot-end-marker ! ! security authentication failure rate 10 log security passwords min-length 6 logging buffered 52000 logging console critical enable secret 4 MHpke6/RnYLNL/fAD5EKDxml.aj8Sr4IJfubMQjIoB2 enable password 7 08331D1F074D031A39 ! aaa new-model ! ! aaa authentication login local_auth local aaa authentication enable default enable ! ! ! ! ! aaa session-id common memory-size iomem 10 clock timezone PCTime 0 0 clock summer-time PCTime date Mar 30 2003 1:00 Oct 26 2003 2:00 ! crypto pki trustpoint TP-self-signed-3612796534 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-3612796534 revocation-check none rsakeypair TP-self-signed-3612796534 ! crypto pki trustpoint test_trustpoint_config_created_for_sdm subject-name e=sdmtest@sdmtest.com revocation-check crl ! crypto pki trustpoint TP-self-signed-1280197465 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-1280197465 revocation-check none rsakeypair TP-self-signed-1280197465 ! ! crypto pki certificate chain TP-self-signed-3612796534 certificate self-signed 01 3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030 31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 69666963 6174652D 33363132 37393635 3334301E 170D3133 31313036 32313131 32385A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 36313237 39363533 3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100E2B4 1AAC762C 3334A5A7 80774D28 79F460FE 4722621B AF0E4D66 A7E95B99 DCCA4BB1 79245905 F2A81499 A38EF6E0 6F2ABF6B 0D11965C 2FFE5E8B 727A49E6 AEDEF4EE 9DE8E459 05F8D143 1AE03B2D 74C704E4 8CB8EAF5 59B41B4B 4A208F29 6ADB6F04 613B8539 DD9ADF83 BEAD1B8A 1E7547EC ADED038D E2968880 DB97D32F B0F50203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304 18301680 147229F4 88EC8C14 4B553D5B C12814C6 FDDF6810 C4301D06 03551D0E 04160414 7229F488 EC8C144B 553D5BC1 2814C6FD DF6810C4 300D0609 2A864886 F70D0101 05050003 81810040 DDA968C6 F002A2E0 E5A67BEE 67F455C5 DC4111F4 E09D06B6 921458BD 1242A007 1683A005 86700B7F 3C75BE0B A05D2304 93DC2C20 36CEE2A7 CC3F793D DFC28E5B 4FDAAF8F 70F8639A 5A6E3FEE C7F36E83 E0C887C7 DD6D3734 4181CEAF C306046B 87601EE6 C7C18A6F EB781459 E60FD070 4956887C 08DDB73D 88A92F58 F5CAB3 quit crypto pki certificate chain test_trustpoint_config_created_for_sdm crypto pki certificate chain TP-self-signed-1280197465 no ip source-route no ip gratuitous-arps ! ! ! ! ! ! no ip bootp server ip domain name uk.access-accounts.com ip name-server 8.8.8.8 ip name-server 172.24.4.13 ip inspect log drop-pkt ip cef login block-for 5 attempts 10 within 5 no ipv6 cef vlan ifdescr detail ! parameter-map type inspect global log dropped-packets enable max-incomplete low 18000 max-incomplete high 20000 spoofed-acker off parameter-map type regex ccp-regex-nonascii pattern [^\x00-\x80] parameter-map type protocol-info yahoo-servers server name scs.msg.yahoo.com server name scsa.msg.yahoo.com server name scsb.msg.yahoo.com server name scsc.msg.yahoo.com server name scsd.msg.yahoo.com server name cs16.msg.dcn.yahoo.com server name cs19.msg.dcn.yahoo.com server name cs42.msg.dcn.yahoo.com server name cs53.msg.dcn.yahoo.com server name cs54.msg.dcn.yahoo.com server name ads1.vip.scd.yahoo.com server name radio1.launch.vip.dal.yahoo.com server name in1.msg.vip.re2.yahoo.com server name data1.my.vip.sc5.yahoo.com server name address1.pim.vip.mud.yahoo.com server name edit.messenger.yahoo.com server name messenger.yahoo.com server name http.pager.yahoo.com server name privacy.yahoo.com server name csa.yahoo.com server name csb.yahoo.com server name csc.yahoo.com parameter-map type protocol-info msn-servers server name messenger.hotmail.com server name gateway.messenger.hotmail.com server name webmessenger.msn.com parameter-map type protocol-info aol-servers server name login.oscar.aol.com server name toc.oscar.aol.com server name oam-d09a.blue.aol.com ! license udi pid CISCO887VA-SEC-K9 sn FCZ173691VC license boot module c880-data level advsecurity ! ! object-group service *ALL description ALL traffic icmp tcp-udp gt 1 icmp echo-reply ! object-group network net-local 172.17.205.0 255.255.255.0 ! object-group network net-remote 172.17.104.0 255.255.255.0 172.17.114.0 255.255.255.0 ! object-group service webtraffic description http and https and dns tcp eq domain tcp eq 443 tcp eq www ! username admin privilege 15 password 7 120B54461C5F0A0901 username Backup-admin privilege 15 view root secret 4 MHpke6/RnYLNL/fAD5EKDxml.aj8Sr4IJfubMQjIoB2 ! ! ! ! ! controller VDSL 0 ! no ip ftp passive ip ssh time-out 60 ip ssh authentication-retries 2 ! crypto logging ezvpn ! crypto isakmp policy 20 encr 3des authentication pre-share group 2 crypto isakmp key encryptionkey address 85.x.x.x crypto isakmp keepalive 10 5 crypto isakmp aggressive-mode disable ! crypto ipsec security-association lifetime seconds 86400 ! crypto ipsec transform-set ADAPTVPN esp-3des esp-sha-hmac mode tunnel ! crypto ipsec profile ADAPT_IPSEC_POLICY set transform-set ADAPTVPN ! ! ! crypto map ADAPTVPN 200 ipsec-isakmp set peer 85.x.x.x set transform-set ADAPTVPN match address 120 ! ! ! ! ! interface Ethernet0 no ip address no ip redirects no ip unreachables no ip proxy-arp ip flow ingress ! interface ATM0 no ip address no ip redirects no ip unreachables no ip proxy-arp ip flow ingress no atm ilmi-keepalive ! interface ATM0.1 point-to-point description TalkTalk VOIP ip flow ingress pvc 0/38 encapsulation aal5snap protocol ppp dialer dialer pool-member 1 ! ! interface FastEthernet0 no ip address ! interface FastEthernet1 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address ! interface Vlan1 description $FW_INSIDE$ ip address 172.17.205.254 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip nbar protocol-discovery ip flow ingress ip flow egress ip nat inside ip virtual-reassembly in ! interface Dialer0 description $FW_OUTSIDE$ ip address negotiated ip mtu 1492 ip nbar protocol-discovery ip flow ingress ip flow egress ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 dialer-group 2 ppp authentication chap pap callin ppp chap hostname my@username ppp chap password 7 133F403E5827530C7D1E7E ppp pap sent-username my@username password 7 0129512808205129777618 no cdp enable crypto map ADAPTVPN ! ip forward-protocol nd ip http server ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ip flow-top-talkers top 10 sort-by bytes cache-timeout 10000 ! ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 ! ip access-list extended Adapt_VPN remark CCP_ACL Category=128 permit ip host 85.x.x.x any ip access-list extended SDM_AH remark CCP_ACL Category=1 permit ahp any any ip access-list extended SDM_ESP remark CCP_ACL Category=1 permit esp any any ip access-list extended SDM_GRE remark CCP_ACL Category=1 permit gre any any ip access-list extended all_traffic-Out permit icmp 172.17.205.0 0.0.0.255 any permit ip 172.17.205.0 0.0.0.255 any ip access-list extended all_traffic_in remark CCP_ACL Category=16 permit ip 172.17.104.0 0.0.0.255 any log permit ip 172.17.112.0 0.0.0.255 any log permit ip 172.24.4.0 0.0.0.255 any log ! ip sla auto discovery logging trap errors logging facility local2 logging host 172.24.4.51 dialer-list 1 protocol ip permit dialer-list 2 protocol ip permit no cdp run ! route-map SDM_RMAP_1 permit 1 match ip address 101 ! snmp-server community SNMP-Public RO snmp-server community SNMP-public RO snmp-server community SNMP-Private RW snmp-server location SSM App Server snmp-server contact Maarten Westera snmp-server host 172.24.4.57 P@ssw0rd access-list 100 remark CCP_ACL Category=128 access-list 100 permit ip host 255.255.255.255 any access-list 100 permit ip 127.0.0.0 0.255.255.255 any access-list 100 permit udp any any eq bootpc access-list 101 remark CCP_ACL Category=18 access-list 101 deny ip 172.17.205.0 0.0.0.255 172.17.104.0 0.0.0.255 access-list 101 deny ip 172.17.205.0 0.0.0.255 172.17.112.0 0.0.0.255 access-list 101 deny ip 172.17.205.0 0.0.0.255 172.24.4.0 0.0.0.255 access-list 101 permit ip 172.17.205.0 0.0.0.255 any access-list 120 remark CCP_ACL Category=20 access-list 120 permit ip 172.17.205.0 0.0.0.255 172.17.104.0 0.0.0.255 access-list 120 permit ip 172.17.205.0 0.0.0.255 172.17.112.0 0.0.0.255 access-list 120 permit ip 172.17.205.0 0.0.0.255 172.24.4.0 0.0.0.255 access-list 122 permit ip 172.17.104.0 0.0.0.255 172.17.205.0 0.0.0.255 access-list 122 permit ip 172.17.112.0 0.0.0.255 172.17.205.0 0.0.0.255 access-list 122 permit ip 172.24.104.0 0.0.0.252 172.17.105.0 0.0.0.255 ! ! ! banner login ############################################# # This device is the property # # # # Unauthorised use is prohibited # ############################################# banner motd THis device is for sole use, Unauthorised sessions are being monitored ! line con 0 login authentication local_auth no modem enable transport output telnet line aux 0 exec-timeout 15 0 login authentication local_auth transport output telnet line vty 0 4 privilege level 15 password 7 09554B1A login authentication local_auth transport input telnet ssh ! ! end
... View more
12-12-2013
08:16 AM
So I blew away all the security zone and zone pairs policy maps and class maps and removed every firewall rule that existed. (most I had created via the CCP wizard) the only thing that remained was the access-lists and still i was unable to ping anything I then decided to create an additional extended Access-list specifying the lan subnet 172.17.205.0 0.0.0.255 to any and specifed the IP protocol and hey presto now I can ping everything it seems the firewall and security zones cant open anything unless you first create an access-list ... I guess I now have an insecure Firewall so will need to add the firewall rules back in that I need and recreate my zone pairs
... View more
12-11-2013
11:40 AM
hi I currently only have the option to ping from the LAN interface of the device as I am not on site and there are no LAn devices connected as of yet. not sure how i could go about removing zone security from an interface?
... View more
12-10-2013
01:11 PM
hi hope someone can help. I have a Cisco 887VA router with an active VPN tunnel configured both internet and VPN are up yet I cannot figure out why I am unable to ping an Internet address or a Lan address at the other end of the VPN tunnel from my vlan1 interface I can ping 8.8.8.8 from the wan interface without any problem so internet is up here is my config -shortened for ease if anyone can see the obvious i would be grateful no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! ! boot-start-marker boot-end-marker ! ! security authentication failure rate 10 log security passwords min-length 6 logging buffered 52000 logging console critical enable secret 4 MHpke6/RnYLNL/fAD5EKDxml.aj8Sr4IJfubMQjIoB2 enable password 7 08331D1F074D031A39 ! aaa new-model ! ! aaa authentication login local_auth local aaa authentication enable default enable ! ! ! ! ! object-group service *ALL description ALL traffic icmp tcp-udp gt 1 icmp echo-reply ! ! controller VDSL 0 ! no ip ftp passive ip ssh time-out 60 ip ssh authentication-retries 2 ! c! zone security in-zone zone security out-zone zone security zx_1615428613 zone security zy_344297763 zone-pair security ccp-zp-self-out source self destination out-zone service-policy type inspect ccp-permit-icmpreply zone-pair security zx-zy_3087709136 source zx_1615428613 destination zy_344297763 service-policy type inspect-internal px-py zone-pair security ccp-zp-in-out source in-zone destination out-zone service-policy type inspect ccp-inspect zone-pair security ccp-zp-out-self source out-zone destination self service-policy type inspect ccp-permit zone-pair security ccp-zp-out-in source out-zone destination in-zone service-policy type inspect out-in-new ! crypto logging ezvpn ! crypto isakmp policy 20 encr 3des authentication pre-share group 2 crypto isakmp key *********************** address 85.x.x.x crypto isakmp keepalive 10 5 crypto isakmp aggressive-mode disable ! crypto ipsec security-association lifetime seconds 86400 ! crypto ipsec transform-set ADAPTVPN esp-3des esp-sha-hmac mode tunnel ! crypto ipsec profile ADAPT_IPSEC_POLICY set transform-set ADAPTVPN ! ! ! crypto map ADAPTVPN 200 ipsec-isakmp set peer 85.x.x.x set transform-set ADAPTVPN match address 120 ! ! interface Ethernet0 no ip address no ip redirects no ip unreachables no ip proxy-arp ip flow ingress ! interface ATM0 no ip address no ip redirects no ip unreachables no ip proxy-arp ip flow ingress no atm ilmi-keepalive ! interface ATM0.1 point-to-point description TalkTalk VOIP ip flow ingress zone-member security out-zone pvc 0/38 encapsulation aal5snap protocol ppp dialer dialer pool-member 1 ! ! interface FastEthernet0 no ip address ! interface FastEthernet1 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address ! interface Vlan1 description $FW_INSIDE$ ip address 172.17.205.254 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip nbar protocol-discovery ip flow ingress ip flow egress ip nat inside ip virtual-reassembly in zone-member security in-zone ! interface Dialer0 description $FW_OUTSIDE$ ip address negotiated ip mtu 1492 ip nbar protocol-discovery ip flow ingress ip flow egress ip nat outside ip virtual-reassembly in zone-member security out-zone encapsulation ppp dialer pool 1 dialer-group 2 ppp authentication chap pap callin ppp chap hostname **********@*********co.uk ppp chap password 7 133F403E5827530C7D1E7E ppp pap sent-username *************@********* password 7 0129512808205129777618 no cdp enable crypto map ADAPTVPN ! ip forward-protocol nd ip http server ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ip flow-top-talkers top 10 sort-by bytes cache-timeout 10000 ! ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 ! ip access-list extended Adapt_VPN remark CCP_ACL Category=128 permit ip host 85.x.x.x any ip access-list extended SDM_AH remark CCP_ACL Category=1 permit ahp any any ip access-list extended SDM_ESP remark CCP_ACL Category=1 permit esp any any ip access-list extended SDM_GRE remark CCP_ACL Category=1 permit gre any any ip access-list extended VPN permit esp any any permit udp any any eq isakmp permit udp any any eq non500-isakmp ip access-list extended VPN_Traffic remark CCP_ACL Category=128 permit ip any host 85.x.x.x ip access-list extended Web_management remark CCP_ACL Category=128 permit ip host 85.x.x.x host 212.x.x.x permit ip host 85.x.x.x host 212.x.x.x ! ip sla auto discovery logging trap errors logging facility local2 logging host 172.24.4.51 dialer-list 1 protocol ip permit dialer-list 2 protocol ip permit no cdp run ! route-map SDM_RMAP_1 permit 1 match ip address 101 ! snmp-server community SNMP-Public RO snmp-server community SNMP-public RO snmp-server community SNMP-Private RW snmp-server location SSM App Server snmp-server contact **** snmp-server host 172.24.4.57 P@ssw0rd access-list 100 remark CCP_ACL Category=128 access-list 100 permit ip host 255.255.255.255 any access-list 100 permit ip 127.0.0.0 0.255.255.255 any access-list 100 permit udp any any eq bootpc access-list 101 remark CCP_ACL Category=18 access-list 101 deny ip 172.17.205.0 0.0.0.255 172.17.104.0 0.0.0.255 access-list 101 deny ip 172.17.205.0 0.0.0.255 172.17.112.0 0.0.0.255 access-list 101 permit ip 172.17.205.0 0.0.0.255 any access-list 120 permit ip 172.17.205.0 0.0.0.255 172.17.104.0 0.0.0.255 access-list 120 permit ip 172.17.205.0 0.0.0.255 172.17.112.0 0.0.0.255 access-list 122 permit ip 172.17.104.0 0.0.0.255 172.17.205.0 0.0.0.255 access-list 122 permit ip 172.17.112.0 0.0.0.255 172.17.205.0 0.0.0.255 ! ! line con 0 login authentication local_auth no modem enable transport output telnet line aux 0 exec-timeout 15 0 login authentication local_auth transport output telnet line vty 0 4 privilege level 15 password 7 09554B1A login authentication local_auth transport input telnet ssh ! ! end
... View more
Labels:
11-07-2013
07:48 AM
thanks james does that mean there is too much noise on the line? which figure is the important one 3.1db or 6.0db as it lists 2 in the noise margin? thanks
... View more
11-07-2013
07:37 AM
HSTCIS887DATA1#show ip int brie Interface IP-Address OK? Method Status Protocol ATM0 unassigned YES NVRAM up up ATM0.1 unassigned YES manual down down Dialer0 unassigned YES IPCP up up Ethernet0 unassigned YES NVRAM down down FastEthernet0 unassigned YES unset down down FastEthernet1 unassigned YES unset up up FastEthernet2 unassigned YES unset down down FastEthernet3 unassigned YES unset down down NVI0 unassigned YES unset administratively down down Virtual-Access1 unassigned YES unset up up Virtual-Access2 unassigned YES unset down down Vlan1 172.24.105.254 YES NVRAM up up
... View more
11-07-2013
05:06 AM
hi can anyone help? i have a cisco 887VA router which lost connection to the WAN and I cant figure out why the Controller VDSL 0 is up the ATM0 Int is up the sub int ATM0.1 is down and i am unable to ping 8.8.8.8 from wan interface or lan interface here is some interface outputs: sh controller vdsl 0 Controller VDSL 0 is UP Daemon Status: Up XTU-R (DS) XTU-C (US) Chip Vendor ID: 'BDCM' 'IFTN' Chip Vendor Specific: 0x0000 0x827A Chip Vendor Country: 0xB500 0xB500 Modem Vendor ID: 'CSCO' ' ' Modem Vendor Specific: 0x4602 0x0000 Modem Vendor Country: 0xB500 0x0000 Serial Number Near: FCZ173691XR 887VA-S 15.3(1)T Serial Number Far: 2301230123012301230123012301230 Modem Version Near: 15.3(1)T Modem Version Far: 0x827a Modem Status: TC Sync (Showtime!) DSL Config Mode: AUTO Trained Mode: G.992.5 (ADSL2+) Annex A TC Mode: ATM Selftest Result: 0x00 DELT configuration: disabled DELT state: not running Trellis: ON ON SRA: disabled disabled SRA count: 0 0 Bit swap: enabled enabled Bit swap count: 9573 0 Line Attenuation: 33.0 dB 19.1 dB Signal Attenuation: 38.9 dB 19.4 dB Noise Margin: 3.1 dB 6.0 dB Attainable Rate: 17452 kbits/s 1076 kbits/s Actual Power: 0.0 dBm 12.6 dBm Total FECC: 311947 0 Total ES: 294 0 Total SES: 27 0 Total LOSS: 0 0 Total UAS: 57 57 Total LPRS: 0 0 Total LOFS: 0 0 Total LOLS: 0 0 Full inits: 1 Failed full inits: 1 Short inits: 1 Failed short inits: 0 Firmware Source File Name (version) -------- ------ ------------------- VDSL embedded VDSL_LINUX_DEV_01212008 (1) Modem FW Version: 120306_1254-4.02L.03.A2pv6C035j.d23j Modem PHY Version: A2pv6C035j.d23j Vendor Version: Ap6v35j.23j 68 DS Channel1 DS Channel0 US Channel1 US Channel0 Speed (kbps): 0 15199 0 1076 SRA Previous Speed: 0 0 0 0 Previous Speed: 0 0 0 0 Total Cells: 0 1045761926 0 73867432 User Cells: 0 9862 0 2948 Reed-Solomon EC: 0 311947 0 0 CRC Errors: 0 1506 0 0 Header Errors: 0 10070 0 0 Interleave (ms): 0.00 7.96 0.00 0.34 Actual INP: 0.00 1.00 0.00 0.00 sh run interface ATM0 no ip address no atm ilmi-keepalive ! interface ATM0.1 point-to-point zone-member security out-zone logging event subif-link-status crypto map ADAPTVPN pvc 0/38 oam-pvc manage encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface FastEthernet0 no ip address ! interface FastEthernet1 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address ! interface Vlan1 description $FW_INSIDE$ ip address MYLOCALIPANDSUBNET no ip redirects no ip unreachables no ip proxy-arp ip nbar protocol-discovery ip flow ingress ip nat inside no ip virtual-reassembly in zone-member security in-zone ! interface Dialer0 mtu 1492 ip address negotiated ip nat outside ip virtual-reassembly in zone-member security out-zone encapsulation ppp dialer pool 1 dialer-group 2 ppp authentication chap pap callin ppp chap hostname MYISPHOSTNAME ppp chap password 7 MYISPPASSWORD ppp pap sent-username MYISPHOSTNAME password 7 MYISPPASSWORD no cdp enable
... View more
Labels:
Created by
JMaartenW
in VPN and AnyConnect
in VPN and AnyConnect
10-30-2013
06:07 AM
10-30-2013
06:07 AM
here is a few more sh commands HSTCIS887VOIP1#show crypto isakmp policy Global IKE policy Protection suite of priority 20 encryption algorithm: Three key triple DES hash algorithm: Secure Hash Standard authentication method: Pre-Shared Key Diffie-Hellman group: #2 (1024 bit) lifetime: 86400 seconds, no volume limit HSTCIS887VOIP1#show crypto ipsec policy HSTCIS887VOIP1#show crypto ipsec sa interface: ATM0.1 Crypto map tag: ADAPTVPN, local addr 0.0.0.0 protected vrf: (none) local ident (addr/mask/prot/port): (172.17.205.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (172.17.104.0/255.255.255.0/0/0) current_peer 85.*.*.* port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 0.0.0.0, remote crypto endpt.: 85.*.*.* path mtu 1600, ip mtu 1600, ip mtu idb ATM0.1 current outbound spi: 0x0(0) PFS (Y/N): N, DH group: none inbound esp sas: inbound ah sas: inbound pcp sas: outbound esp sas: outbound ah sas: outbound pcp sas: HSTCIS887VOIP1#show crypto ipsec profile IPSEC profile default Security association lifetime: 4608000 kilobytes/3600 seconds Responder-Only (Y/N): N PFS (Y/N): N Transform sets={ default: { esp-aes esp-sha-hmac } , } HSTCIS887VOIP1#show crypto ipsec client % Incomplete command. HSTCIS887VOIP1#show crypto ipsec security-association Security association lifetime: 4608000 kilobytes/86400 seconds HSTCIS887VOIP1#show crypto ipsec transform-set Transform set default: { esp-aes esp-sha-hmac } will negotiate = { Transport, }, Transform set ADAPTVPN: { esp-3des esp-sha-hmac } will negotiate = { Tunnel, }, HSTCIS887VOIP1#show crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status IPv6 Crypto ISAKMP SA HSTCIS887VOIP1#show crypto isakmp peers HSTCIS887VOIP1#show crypto isakmp key Keyring Hostname/Address Preshared Key default 85.*.*.* mypresharedkey
... View more
09-18-2018
do you know what!!! I've looked and changed that several times and now
realise the typo in 0x2100 TH...
09-18-2018
I am able to boot into the IOS but only manually from ROMMON the device
will not power up into ios a...
09-18-2018
I have issues upgrading this router due to "not enough space" problems I
was unable to upgrade the r...
05-02-2014
Hi, I know this question is probably very common but I am still having
issues with understanding ACL...
12-13-2013
Thank you so much for your help in this. I will go ahead and figure out
how to apply those and then ...
12-12-2013
hino ZBF at the moment obviously I'm going to have to put it back and I
probably will use the CCP wi...
12-12-2013
hi I intially tried removing the interfaces from the zones but I was
still unable to ping anything f...
12-12-2013
So I blew away all the security zone and zone pairs policy maps and
class maps and removed every fir...
12-11-2013
hi I currently only have the option to ping from the LAN interface of
the device as I am not on site...
12-10-2013
hi hope someone can help.I have a Cisco 887VA router with an active VPN
tunnel configured both inter...
11-07-2013
thanks jamesdoes that mean there is too much noise on the line? which
figure is the important one 3....
11-07-2013
HSTCIS887DATA1#show ip int brieInterface IP-Address OK? Method Status
ProtocolATM0 unassigned YES NV...
11-07-2013
hi can anyone help?i have a cisco 887VA router which lost connection to
the WAN and I cant figure ou...
Public Statistics
| Date Registered | 10-07-2013 11:47 AM |
| Date Last Visited | 09-25-2018 09:29 AM |
| Total Messages Posted | 18 |
.jpg "VIP Advisor"){kind=icon}
